Package: karton-core
KartonDistributed malware processing framework based on Python, Redis and S3.The ideaKarton is a robust framework for creatingflexibleandlightweightmalware analysis backends.
It can be used to connect malware* analysis systems into a robust pipeline with very little effort.We've been in the automation business for a long time. We're dealing with more and more threats, and we have to automate everything to keep up with incidents. Because of this, we often end up with many scripts stuck together withduckduct tape and WD-40. These scripts are written by analysts in the heat of the moment, fragile and ugly - but they work, and produce intel that must be stored, processed further, sent to other systems or shared with other organisations.We needed a way to take our PoC scripts and easily insert them into our analysis pipeline. We also wanted to monitor their execution, centralise logging, improve robustness, reduce development inertia... For this exact purpose, we createdKarton.* while Karton was designed with malware analysis in mind, it works nicely in every microservice-oriented project.InstallationInstallation is as easy as a singlepip installcommand:pip3 install karton-coreIn order to setup the whole backend environment you will also need S3-compatible storage and Redis, see thedocsfor details.Example usageTo use karton you have to provide class that inherits from Karton.fromkarton.coreimportKarton,Task,ResourceclassGenericUnpacker(Karton):"""Performs sample unpacking"""identity="karton.generic-unpacker"filters=[{"type":"sample","kind":"runnable","platform":"win32"}]defprocess(self,task:Task)->None:# Get sample objectpacked_sample=task.get_resource('sample')# Log with self.logself.log.info(f"Hi{packed_sample.name}, let me analyze you!")...# Send our results for further processing or reportingtask=Task({"type":"sample","kind":"raw"},payload={"parent":packed_sample,"sample":Resource(filename,unpacked)})self.send_task(task)if__name__=="__main__":GenericUnpacker.main()Karton systemsSome Karton systems are universal and useful to everyone. We decided to share them with the community.kartonThis repository. It contains thekarton.systemservice - main service, responsible for dispatching tasks within the system. It also contains thekarton.coremodule, that is used as a library by other systems.karton-dashboardA small Flask dashboard for task and queue management and monitoring.karton-classifierThe "router". It recognises samples/files and produces various task types depending on the file format. Thanks to this, other systems may only listen for tasks with a specific format (for example, onlyziparchives).karton-archive-extractorGeneric archive unpacker. Archives uploaded into the system will be extracted, and every file will be processed individually.karton-config-extractorMalware extractor. It uses Yara rules and Python modules to extract static configuration from malware samples and analyses. It's a fishing rod, not a fish - we don't share the modules themselves. But it's easy to write your own!karton-mwdb-reporterA very important part of the pipeline. Reporter submits all files, tags, comments and other intel produced during the analysis toMWDB. If you don't use MWDB yet or just prefer other backends, it's easy to write your own reporter.karton-yaramatcherAutomatically runs Yara rules on all files in the pipeline, and tags samples appropriately. Rules not included ;).karton-asciimagicKarton system that decodes files encoded with common methods, likehex,base64, etc. (You wouldn't believe how common it is).karton-autoit-ripperA small wrapper aroundAutoIt-Ripperthat extracts embedded AutoIt scripts and resources from compiled AutoIt executables.DRAKVUF SandboxAutomated black-box malware analysis system with DRAKVUF engine under the hood, which does not require an agent on guest OS.This is how these systems can be used to form a basic malware analysis pipeline:Community projects that incorporate the Karton frameworkc3rb3ru5d3d53c/karton-unpackerA modular Karton Framework service that unpacks common packers like UPX and others using the Qiling Framework.c3rb3ru5d3d53c/mwcfg/c3rb3ru5d3d53c/mwcfg-modulesA Feature Rich Modular Malware Configuration Extraction Utility for MalDuckraw-data/karton-die-classifierDetect-It-Easy classifier for the Karton frameworkraw-data/karton-retdec-unpackerRetDec unpacker module for the Karton frameworkW3ndige/aurora/W3ndige/karton-similarityMalware similarity platform with modularity in mind.