Malice - VirusTotal Wanna Be (Now With 100% More Hipster)

DEMO:demo.malice.io

• username: malice
• password: ecilam

• ~16GB disk space
• ~4GB RAM

• Docker

$ brew install maliceio/tap/malice

Usage: malice [OPTIONS] COMMAND [arg...]

Open Source Malware Analysis Framework

Version: 0.3.11

Author:
  blacktop - <https://github.com/blacktop>

Options:
  --debug, -D      Enable debug mode [$MALICE_DEBUG]
  --help, -h       show help
  --version, -v    print the version

Commands:
  scan        Scan a file
  watch        Watch a folder
  lookup    Look up a file hash
  elk        Start an ELK docker container
  plugin    List, Install or Remove Plugins
  help        Shows a list of commands or help for one command

Run 'malice COMMAND --help' for more information on a command.

$ malice scan evil.malware

NOTE: On the first run malice will download all of it's default plugins which can take a while to complete.

$ malice elk

You can open the Kibana UI and look at the scan results here: http://localhost (assuming you are using Docker for Mac)

• Type in malice as the Index name or pattern and click Create.
  
• Now click on the Malice Tab and behold!!!
  

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock malice/engine plugin update --all

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
                -v `pwd`:/malice/samples \
                -e MALICE_VT_API=$MALICE_VT_API \
                malice/engine scan SAMPLE

• Documentation
• Plugins
• Examples
• Roadmap
• Contributing