Malice FLOSS Plugin
This repository contains a Dockerfile of the FLOSS malice plugin malice/floss.
- Install Docker.
- Download trusted build from public DockerHub:
docker pull malice/floss
docker run --rm -v /path/to/file:/malware:ro malice/floss FILE
Usage: floss [OPTIONS] COMMAND [arg...]
Malice FLOSS Plugin
Version: v0.1.0, BuildTime: 20180903
Author:
blacktop - <https://github.com/blacktop>
Options:
--verbose, -V verbose output
--timeout value malice plugin timeout (in seconds) (default: 120) [$MALICE_TIMEOUT]
--elasticsearch value elasticsearch url for Malice to store results [$MALICE_ELASTICSEARCH_URL]
--callback, -c POST results to Malice webhook [$MALICE_ENDPOINT]
--proxy, -x proxy settings for Malice webhook endpoint [$MALICE_PROXY]
--table, -t output as Markdown table
--all, -a output ascii/utf-16 strings
--help, -h show help
--version, -v print the version
Commands:
web Create a FLOSS scan web service
help Shows a list of commands or help for one command
Run 'floss COMMAND --help' for more information on a command.
This will output to stdout and POST to malice results API webhook endpoint.
{
"floss": {
"ascii": null,
"utf-16": null,
"decoded": [
{
"location": "0x401059",
"strings": [
"*lecnaC*",
"Software\\Microsoft\\CurrentNetInf",
"SYSTEM\\CurrentControlSet\\Control\\Lsa",
"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
"MicrosoftZj",
"LhbqnrnesDwhs",
"MicrosoftHaveExit",
"LhbqnrnesG`ud@bj",
"IEXPLORE.EXE",
"/ver.htm",
"/exe.htm",
"/app.htm",
"/myapp.htm",
"/hostlist.htm",
".a`j-gsl",
"/SomeUpList.htm",
"/SomeUpVer.htm",
"www.flyeagles.com",
"www.km-nyc.com",
"/restore",
"/dizhi.gif",
"/connect.gif",
"\\$NtUninstallKB900727$",
"\\netsvc.exe",
"\\netscv.exe",
"\\netsvcs.exe",
"System Idle Process",
"Program Files",
"\\Internet Exp1orer",
"forceguest",
"AudioPort",
"AudioPort.sys",
"SYSTEM\\CurrentControlSet\\Services",
"SYSTEM\\ControlSet001\\Services",
"SYSTEM\\ControlSet002\\Services",
"\\drivers\\",
"\\DriverNum.dat"
]
},
{
"location": "0x404DDE",
"strings": [
"SMBs",
"NTLMSSP",
"Windows 2000 2195",
"Windows 2000 5.0",
"SMBr",
"PC NETWORK PROGRAM 1.0",
"LANMAN1.0",
"Windows for Workgroups 3.1a",
"LM1.2X002",
"LANMAN2.1",
"NT LM 0.12"
]
},
{
"location": "0x401047",
"strings": ["Ie_nkokbpAtep", "+^]g*dpi", "Ie_nkokbpD]ra=_g"]
}
],
"stack": ["cmd.exe"]
}
}
Location: 0x401059
*lecnaC*
Software\Microsoft\CurrentNetInf
SYSTEM\CurrentControlSet\Control\Lsa
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
MicrosoftZj
LhbqnrnesDwhs
MicrosoftHaveExit
LhbqnrnesG
ud@bj`IEXPLORE.EXE
/ver.htm
/exe.htm
/app.htm
/myapp.htm
/hostlist.htm
.a
j-gsl`/SomeUpList.htm
/SomeUpVer.htm
www.flyeagles.com
www.km-nyc.com
/restore
/dizhi.gif
/connect.gif
\$NtUninstallKB900727$
\netsvc.exe
\netscv.exe
\netsvcs.exe
System Idle Process
Program Files
\Internet Exp1orer
forceguest
AudioPort
AudioPort.sys
SYSTEM\CurrentControlSet\Services
SYSTEM\ControlSet001\Services
SYSTEM\ControlSet002\Services
\drivers\
\DriverNum.dat
Location: 0x404DDE
SMBs
NTLMSSP
Windows 2000 2195
Windows 2000 5.0
SMBr
PC NETWORK PROGRAM 1.0
LANMAN1.0
Windows for Workgroups 3.1a
LM1.2X002
LANMAN2.1
NT LM 0.12
Location: 0x401047
Ie_nkokbpAtep
+^]g*dpi
Ie_nkokbpD]ra=_g
cmd.exe
Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to file an issue
See CHANGELOG.md
See all contributors on GitHub.
Please update the CHANGELOG.md and submit a Pull Request on GitHub.
- https://bitbucket.org/cse-assemblyline/alsvc_frankenstrings
- prevent URLs from being rendered as links in MarkDown
⚠️
MIT Copyright (c) 2016 blacktop