Release notes for v25.07.0 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
My team develops #Zeek network analyzers for #OT protocols (see ICSNPP on GitHub). If you're familiar with this work, you know one of the hardest parts about it is getting sample data. If you've got access to traffic for some of the more niche protocols on our list (BSAP, ANSI C12.22, GE-SRTP, GENISYS, ROC Plus, Synchrophasor, etc.) and are willing and able to share a bit of PCAP, would you please reach out to me?
2025-07-23 (Wednesday): Ten days of scans and probes and web traffic hitting my web server.
A #pcap of the traffic is available at https://www.malware-traffic-analysis.net/2025/07/23/index.html
2025-07-15 (Tuesday): #LummaStealer infection with #SecTopRAT.
A #pcap of the #Lumma traffic and #SecTop #RAT activity, the #malware/artifacts from an infection, and the associated IOCs are available at https://www.malware-traffic-analysis.net/2025/07/15/index.html
2025-07-02 (Wednesday): Another #LummaStealer infection with follow-up #Rsockstun #malware.
The #Lumma Stealer infection uses a password-protected 7-zip archive, a NullSoft installer, and #AutoItv3.
Malware samples, a #pcap and some IOCs are available at https://www.malware-traffic-analysis.net/2025/07/02/index.html
Hey, y'all, if you have anything to do with the Zeek network security monitor (as a user, script/plugin developer, researcher, whatever), would you please take 10 minutes to fill out the Zeek Project Survey 2025. This is your chance to help the Zeek team know how you feel about the project and help shape its direction moving forward.
[Still haven't sorted this as of 2025-07-12]
#AskFedi #BoostsAreAppreciated #Linux #BSD #Networking #PCAP
I am looking for some kind of VM or system I can run to create a network that I can put an untrusted device on to and allow/deny all its connections one by one - think auditioning a new TV or IOT device rather than out-and-out hostile malware. Assume I will also dump packets for investigation.
Security Onion looks like overkill but I'd like to avoid writing my own firewall rules if possible.
2025-06-26 (Thursday): #LummaStealer infection leads to follow-up loader that retrieves a pen test tool hosted on Github and configures it as #malware.
A #pcap of the infection traffic, the associated malware, and IOCs are available at: https://www.malware-traffic-analysis.net/2025/06/26/index.html
On August 1, Linkage Community will begin operating independently from the University of Michigan’s Prison Creative Arts Project, where the group got its start as a space for formerly incarcerated creatives to thrive during the transition from prison back to their Michigan communities. This is a major milestone, marking growth of the group beyond its origins as a part of the University’s […]
https://votingaccessforall.org/2025/06/linkage-community-launches-as-independent-organization/
Release notes for v25.06.0 of Malcolm, a powerful, easily deployable network traffic analysis tool suite for network security monitoring
2025-06-21 (Saturday): #KoiLoader / #KoiStealer infection.
A #pcap of the infection traffic, associated malware/files, and some of the indicators are available at https://www.malware-traffic-analysis.net/2025/06/21/index.html
025-06-20 (Friday): From a post I wrote for my employer on other social media about distribution of #malware disguised as cracked software.
The malware is contained in password-protected 7-Zip archives to avoid detection.
A #pcap from running the malware, and the associated malware files are available at https://www.malware-traffic-analysis.net/2025/06/20/index.html
I don't know what this malware is, so if anyone knows, feel free to reply. I'm just here for the memes.
2025-06-18 (Wednesday): #SmartApeSG --> #ClickFix lure --> #NetSupportRAT --> #StealCv2
A #pcap of the traffic, the malware/artifacts, and some IOCs are available at https://www.malware-traffic-analysis.net/2025/06/18/index.html.
Today's the 12th anniversary of my first blog post on malware-traffic-analysis.net, so I made this post a bit more old school.
2025-06-10 (Tuesday): Ten days of scans and probes and web traffic to a web server I run (not my blog web server, but another one).
After helping a coworker review an Apache Tomcat vulnerability, I opened TCP port 8080 to accept web traffic requests.
A #pcap of the traffic is available at: https://www.malware-traffic-analysis.net/2025/06/10/index.html
@Alonso_ReYDeS i say sniff 24/7 or else what the heck are you doing? #pcap #arkime #suri
CapLoader 2.0 released today!
Identifies over 250 protocols in #PCAP
Define protocols from example traffic
🇶 Extracts JA3, JA4 and SNI from QUIC
10x faster user interface
https://netresec.com/?b=256dbbc
https://www.noslang.com/search/poidnh claims that #POIDNH stands for #PicsOrItDidNotHappen. But I knew it as #PCAPsOrItDidNotHappen 
MalChela 2.2 “REMnux” Release
MalChela’s 2.2 update is packed with practical and platform-friendly improvements. It includes native support for REMnux, better tool settings, and deeper integrations with analysis tools like YARA-X, Tshark, Volatility3, and the newly improved fileanalyzer module.
REMnux Edition: Built-In Support, Zero Tweaks
When the GUI loads a REMnux-specific tools.yaml profile, it enters REMnux mode.
Screenshot of yaml configuration applying REMnux modeNative binaries and Python scripts like capa, oledump.py, olevba, and FLOSS are loaded into the MalChela tools menu, allowing you to mix and match operations with the embedded MalChela utilities and the full REMnux tool stack. No manual configuration needed—just launch and go. MalChela currently supports the following REMnux programs right out of the box:
Tool NameDescriptionbinwalkFirmware analysis and extraction toolcapaIdentifies capabilities in executable filesradare2Advanced reverse engineering frameworkVolatility 3Memory forensics framework for RAM analysisexiftoolExtracts metadata from images, documents, and moreTSharkTerminal-based network packet analyzer (Wireshark CLI)mraptorDetects malicious macros in Office documentsoledumpParses OLE files and embedded streamsoleidIdentifies features in OLE files that may indicate threatsolevbaExtracts and analyzes VBA macros from Office filesrtfobjExtracts embedded objects from RTF documentszipdumpInspects contents of ZIP files, including suspicious payloadspdf-parserAnalyzes structure and contents of suspicious PDFsFLOSSReveals obfuscated and decoded strings in binariesclamscanOn-demand virus scanner using ClamAV enginestringsExtracts printable strings from binary filesYARA-XNext-generation high-performance YARA rule scannerIf you only need a subset of tools you can easily save and restore that a custom profile.
TShark Panel with Built-In Reference
Tshark and the integrated field referenceA new TShark integration exposes features including:
This helps analysts build and understand filters quickly—even if TShark isn’t something they use every day. Using the syntax builder in MalChela you can use the exact commands directly in Tshark or Wireshark.
YARA-X Support (Install Guide Included)
YARA-X module in MalChelaSupport for YARA-X (via the `yr` binary) is now built in. YARA-X is not bundled with REMnux by default, but install instructions are included in the User Guide for both macOS and Linux users.
Once installed, MalChela allows for rule-based scanning from the GUI,and with YARA-X, it’s faster than ever.
fileanalyzer: Fuzzy Hashing, PE Metadata, and More
Updated FileAnalyzer ModuleMalChela’s fileanalyzer tool has also been updated to include:
These improvements provide deeper insight into executable structure, helping analysts detect anomalies such as packers, suspicious timestamps, or unexpected imports/exports. Useful for everything from sample triage to correlation, fileanalyzer now digs deeper—without slowing down.
Memory Forensics Gets a Boost: Volatility 3 Now Supported
With the 2.2 release, MalChela introduces support for Volatility 3, the modern Python-based memory forensics framework. Whether you’re running MalChela in REMnux or on a customized macOS or Linux setup, you can now access the full power of Volatility directly from the MalChela GUI.
Volatility 3 in MalChelaThere’s an intuitive plugin selector that dynamically adjusts available arguments based on your chosen plugin,. You can search, sort, and browse available plugins, and even toggle output options like –dump-dir with ease.
Like Tshark, there is an added plugin reference panel with searchable descriptions and argument overviews — a real time-saver when navigating Volatility’s deep and often complex toolset.
Volatility Plugin ReferenceSmarter Tool Configuration via YAML
The tool configuration system continues to evolve:
This structure helps keep things clean—whether you’re testing, teaching, or deploying in a lab environment.
Embedded Documentation Access
The GUI now includes a link to the full MalChela User Guide in PDF. You can also access the documentation online.
From tool usage and CLI flags to configuration tips and install steps, it’s all just a click away—especially useful in offline environments or when onboarding new analysts. I’ll be honest, this is likely the most comprehensive user guide I’ve ever written.
Whether you’re reviewing binaries, building hash sets, or exploring network captures—MalChela 2.2 is designed bring together the tools you need, and make it easier to interoperate between them.
The new REMnux mode makes it even easier to get up and running with dozens of third party integrations.
Have an idea for a feature or application you’d like to see supported — reach out to me.
GitHub: REMnux Release
| R.I.P Natenom 