abc1230940/malware-scanner
GitHub: abc1230940/malware-scanner
一款基于 Python 的本地恶意软件威胁狩猎工具，通过输入文件 SHA-256 哈希值在全盘范围内定位恶意文件路径，辅助事件响应人员快速排查和处置。
Stars: 0 | Forks: 0
Malware Scanner
A python threat-hunting malware scanning tool by inputting SHA256 file hash
(返回顶部)
About the Project
This tool is designed to hunt for specific malware dropped by an attacker or spawned by a malicious payload. These threats often attempt to establish persistence on a system to reconnect to the attacker's Command and Control (C2) server upon reboot. By inputting the target malware's SHA-256 hash value, the script scans the entire file system to locate the file. Once a match is found, the script outputs the exact file path so the incident responder can take immediate remediation action.
Built With
Language
快速开始
该恶意软件扫描程序在 unix 系统上使用，请确保系统已更新并安装了带有虚拟环境的 Python。前置条件
1. 系统更新及 Python 安装
sudo apt update && sudo apt install -y python3.12-venv
安装说明
1. 克隆仓库
git clone https://github.com/abc1230940/malware-scanner.git
2. 进入文件夹
cd malware_scanner
3. 设置虚拟环境
python3 -m venv env
4. 激活虚拟环境
source env/bin/activate
5. 完成后停用虚拟环境
deactivate
(返回顶部)
Usage
1. Edit the python script and then save
The script was designed to scan the root directory ("/"), and we need to exclude the scanner from searching the directories /proc, /sys, /dev, /snap and /run because they contain virtual, dynamic kernel processes and hardware streams that do not exist on the physical disk, which would otherwise cause the program to hang, freeze, or crash.
You can also scan the targeted directories which attacker may drop the malware:
- /tmp
- /var/tmp
- /dev/shm
- /etc/cron.*
- /etc/bin
2. Launch the malware scanner script
python3 malware_scanner.py
3. Input SHA-256 hash value and press Enter
I inputted the SHA-256 of "Malware": a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447
4. Result
The targeted "malware" was found! The path is "/tmp/malware/real_malware/hello_world.txt"
Acknowledgement
LetsDefend - Python for Blue Team
