Skip to content

Commit a0cb5ea

Browse files
mlodicmlodic
committed
merge from master
2 parents f3ac867 + 454db9b commit a0cb5ea

File tree

40 files changed

+453
-192
lines changed

40 files changed

+453
-192
lines changed

‎.github/CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,16 @@
22

33
[**Upgrade Guide**](https://intelowlproject.github.io/docs/IntelOwl/installation/#update-to-the-most-recent-version)
44

5+
## [v6.3.0](https://github.com/intelowlproject/IntelOwl/releases/tag/v6.3.0)
6+
7+
This release brings official support for ARM architecture. From now on, our Docker builds are multi-platform. You can now run IntelOwl in your favourite ARM machine smoothly, e.g. Apple Silicon Mac and Raspberry PI.
8+
9+
We have few new analyzers that you can play with (in particular new Vulnerability scanners like WAD, Nuclei) and updated Abuse.Ch analyzers to allow the configuration of your API key.
10+
11+
Then we have a lot of fixes and dependencies upgrades as usual.
12+
13+
Happy hunting!
14+
515
## [v6.2.1](https://github.com/intelowlproject/IntelOwl/releases/tag/v6.2.1)
616
Minor fixes and dependencies upgrades
717

‎.github/dependabot.yml‎

Lines changed: 40 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ updates:
77
day: "tuesday"
88
target-branch: "develop"
99
ignore:
10-
# ignore all patch updates since we are using ~=
11-
# this does not work for security updates
1210
- dependency-name: "*"
1311
update-types: ["version-update:semver-patch"]
1412
- dependency-name: "boto3"
@@ -23,8 +21,6 @@ updates:
2321
day: "tuesday"
2422
target-branch: "develop"
2523
ignore:
26-
# ignore all patch updates since we are using ~=
27-
# this does not work for security updates
2824
- dependency-name: "*"
2925
update-types: ["version-update:semver-patch"]
3026

@@ -35,8 +31,6 @@ updates:
3531
day: "tuesday"
3632
target-branch: "develop"
3733
ignore:
38-
# ignore all patch updates since we are using ~=
39-
# this does not work for security updates
4034
- dependency-name: "*"
4135
update-types: [ "version-update:semver-patch" ]
4236

@@ -46,6 +40,16 @@ updates:
4640
interval: "weekly"
4741
day: "tuesday"
4842
target-branch: "develop"
43+
ignore:
44+
- dependency-name: "*"
45+
update-types: [ "version-update:semver-patch" ]
46+
47+
- package-ecosystem: "pip"
48+
directory: "/integrations/nuclei_analyzer"
49+
schedule:
50+
interval: "weekly"
51+
day: "tuesday"
52+
target-branch: "develop"
4953
ignore:
5054
# ignore all patch updates since we are using ~=
5155
# this does not work for security updates
@@ -71,8 +75,6 @@ updates:
7175
day: "tuesday"
7276
target-branch: "develop"
7377
ignore:
74-
# ignore all patch updates since we are using ~=
75-
# this does not work for security updates
7678
- dependency-name: "*"
7779
update-types: [ "version-update:semver-patch" ]
7880

@@ -92,8 +94,6 @@ updates:
9294
day: "tuesday"
9395
target-branch: "develop"
9496
ignore:
95-
# ignore all patch updates since we are using ~=
96-
# this does not work for security updates
9797
- dependency-name: "*"
9898
update-types: ["version-update:semver-patch"]
9999

@@ -104,8 +104,6 @@ updates:
104104
day: "tuesday"
105105
target-branch: "develop"
106106
ignore:
107-
# ignore all patch updates since we are using ~=
108-
# this does not work for security updates
109107
- dependency-name: "*"
110108
update-types: ["version-update:semver-patch"]
111109

@@ -116,8 +114,6 @@ updates:
116114
day: "tuesday"
117115
target-branch: "develop"
118116
ignore:
119-
# ignore all patch updates since we are using ~=
120-
# this does not work for security updates
121117
- dependency-name: "*"
122118
update-types: ["version-update:semver-patch"]
123119

@@ -127,6 +123,26 @@ updates:
127123
interval: "weekly"
128124
day: "tuesday"
129125
target-branch: "develop"
126+
ignore:
127+
- dependency-name: "*"
128+
update-types: ["version-update:semver-patch"]
129+
130+
- package-ecosystem: "docker"
131+
directory: "/integrations/cyberchef"
132+
schedule:
133+
interval: "weekly"
134+
day: "tuesday"
135+
target-branch: "develop"
136+
ignore:
137+
- dependency-name: "*"
138+
update-types: ["version-update:semver-patch"]
139+
140+
- package-ecosystem: "docker"
141+
directory: "/integrations/nuclei_analyzer"
142+
schedule:
143+
interval: "weekly"
144+
day: "tuesday"
145+
target-branch: "develop"
130146
ignore:
131147
# ignore all patch updates since we are using ~=
132148
# this does not work for security updates
@@ -152,20 +168,26 @@ updates:
152168
day: "tuesday"
153169
target-branch: "develop"
154170
ignore:
155-
# ignore all patch updates since we are using ~=
156-
# this does not work for security updates
157171
- dependency-name: "*"
158172
update-types: ["version-update:semver-patch"]
159173

174+
- package-ecosystem: "docker"
175+
directory: "/integrations/thug"
176+
schedule:
177+
interval: "weekly"
178+
day: "tuesday"
179+
target-branch: "develop"
180+
ignore:
181+
- dependency-name: "*"
182+
update-types: [ "version-update:semver-patch" ]
183+
160184
- package-ecosystem: "docker"
161185
directory: "/integrations/phishing_analyzers"
162186
schedule:
163187
interval: "weekly"
164188
day: "tuesday"
165189
target-branch: "develop"
166190
ignore:
167-
# ignore all patch updates since we are using ~=
168-
# this does not work for security updates
169191
- dependency-name: "*"
170192
update-types: ["version-update:semver-patch"]
171193

@@ -176,7 +198,5 @@ updates:
176198
day: "tuesday"
177199
target-branch: "develop"
178200
ignore:
179-
# ignore all patch updates since we are using ~=
180-
# this does not work for security updates
181201
- dependency-name: "*"
182202
update-types: ["version-update:semver-patch"]

‎README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,10 @@ To know more about the project and its growth over time, you may be interested i
5555

5656
You can see the full list of all available analyzers in the [documentation](https://intelowlproject.github.io/docs/IntelOwl/usage/#analyzers).
5757

58-
| Type | Analyzers Available |
59-
| -------------------------------------------------- |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
60-
| Inbuilt modules | - Static Office Document, RTF, PDF, PE, ELF, APK File Analysis and metadata extraction<br/> - Strings Deobfuscation and analysis ([FLOSS](https://github.com/mandiant/flare-floss), [Stringsifter](https://github.com/mandiant/stringsifter), ...)<br/> - [Yara](https://virustotal.github.io/yara/), [ClamAV](https://www.clamav.net/) (a lot of public rules are available. You can also add your own rules)<br/> - PE Emulation with [Qiling](https://github.com/qilingframework/qiling) and [Speakeasy](https://github.com/mandiant/speakeasy)<br/> - PE Signature verification<br/> - PE Capabilities Extraction ([CAPA](https://github.com/mandiant/capa) and [Blint](https://github.com/owasp-dep-scan/blint))<br/> - Javascript Emulation ([Box-js](https://github.com/CapacitorSet/box-js))<br/> - Android Malware Analysis ([Quark-Engine](https://github.com/quark-engine/quark-engine), [Androguard](https://github.com/androguard/androguard), [Mobsf](https://github.com/MobSF/mobsfscan/), ...)<br/> - SPF and DMARC Validator<br/> - PCAP Analysis with [Suricata](https://github.com/OISF/suricata) and [Hfinger](https://github.com/CERT-Polska/hfinger) <br/> - Scanners ([WAD](https://github.com/CERN-CERT/WAD), [Nuclei](https://github.com/projectdiscovery/nuclei), ...) <br/> - more... |
61-
| External services | - Abuse.ch <a href="https://bazaar.abuse.ch/about/" target="_blank">MalwareBazaar</a>/<a href="https://urlhaus.abuse.ch/" target="_blank">URLhaus</a>/<a href="https://threatfox.abuse.ch/about/" target="_blank">Threatfox</a>/<a href="https://yaraify.abuse.ch/about/" target="_blank">YARAify</a></br> - <a href="https://docs.greynoise.io/docs/3rd-party-integrations" target="_blank"> GreyNoise v2</a><br/> - <a href="https://analyze.intezer.com/?utm_source=IntelOwl" target="_blank"> Intezer</a><br/> - VirusTotal v3<br/> - <a href="https://doc.crowdsec.net/docs/next/cti_api/integration_intelowl/?utm_source=IntelOwl" target="_blank"> Crowdsec</a><br/> - <a href="https://urlscan.io/docs/integrations/" target="_blank">URLscan</a><br/> - Shodan<br/> - AlienVault OTX<br/> - <a href="https://intelx.io/integrations" target="_blank">Intelligence_X</a><br/> - <a href="https://www.misp-project.org/" target="_blank">MISP</a><br/> - many more.. |
58+
| Type | Analyzers Available |
59+
| -------------------------------------------------- |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
60+
| Inbuilt modules | - Static Office Document, RTF, PDF, PE, ELF, APK File Analysis and metadata extraction<br/> - Strings Deobfuscation and analysis ([FLOSS](https://github.com/mandiant/flare-floss), [Stringsifter](https://github.com/mandiant/stringsifter), ...)<br/> - [Yara](https://virustotal.github.io/yara/), [ClamAV](https://www.clamav.net/) (a lot of public rules are available. You can also add your own rules)<br/> - PE Emulation with [Qiling](https://github.com/qilingframework/qiling) and [Speakeasy](https://github.com/mandiant/speakeasy)<br/> - PE Signature verification<br/> - PE Capabilities Extraction ([CAPA](https://github.com/mandiant/capa) and [Blint](https://github.com/owasp-dep-scan/blint))<br/> - Javascript Emulation ([Box-js](https://github.com/CapacitorSet/box-js))<br/> - Android Malware Analysis ([Quark-Engine](https://github.com/quark-engine/quark-engine), [Androguard](https://github.com/androguard/androguard), [Mobsf](https://github.com/MobSF/mobsfscan/), ...)<br/> - SPF and DMARC Validator<br/> - PCAP Analysis with [Suricata](https://github.com/OISF/suricata) and [Hfinger](https://github.com/CERT-Polska/hfinger) <br/> - Honeyclients ([Thug](https://github.com/buffer/thug), [Selenium](https://github.com/wkeeling/selenium-wire)) <br/> - Scanners ([WAD](https://github.com/CERN-CERT/WAD), [Nuclei](https://github.com/projectdiscovery/nuclei), ...) <br/> - more... |
61+
| External services | - Abuse.ch <a href="https://bazaar.abuse.ch/about/" target="_blank">MalwareBazaar</a>/<a href="https://urlhaus.abuse.ch/" target="_blank">URLhaus</a>/<a href="https://threatfox.abuse.ch/about/" target="_blank">Threatfox</a>/<a href="https://yaraify.abuse.ch/about/" target="_blank">YARAify</a></br> - <a href="https://docs.greynoise.io/docs/3rd-party-integrations" target="_blank"> GreyNoise v2</a><br/> - <a href="https://analyze.intezer.com/?utm_source=IntelOwl" target="_blank"> Intezer</a><br/> - VirusTotal v3<br/> - <a href="https://doc.crowdsec.net/docs/next/cti_api/integration_intelowl/?utm_source=IntelOwl" target="_blank"> Crowdsec</a><br/> - <a href="https://urlscan.io/docs/integrations/" target="_blank">URLscan</a><br/> - Shodan<br/> - AlienVault OTX<br/> - <a href="https://intelx.io/integrations" target="_blank">Intelligence_X</a><br/> - <a href="https://www.misp-project.org/" target="_blank">MISP</a><br/> - many more.. |
6262

6363
## Partnerships and sponsors
6464

‎api_app/analyzers_manager/file_analyzers/detectiteasy.py‎

Lines changed: 40 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,61 @@
1+
import json
12
import logging
23

3-
from api_app.analyzers_manager.classes import DockerBasedAnalyzer, FileAnalyzer
4+
import die
5+
6+
from api_app.analyzers_manager.classes import FileAnalyzer
47
from tests.mock_utils import MockUpResponse
58

69
logger = logging.getLogger(__name__)
710

811

9-
class DetectItEasy(FileAnalyzer, DockerBasedAnalyzer):
10-
name: str = "executable_analyzer"
11-
url: str = "http://malware_tools_analyzers:4002/die"
12-
# http request polling max number of tries
13-
max_tries: int = 10
14-
# interval between http request polling (in secs)
15-
poll_distance: int = 1
12+
class DetectItEasy(FileAnalyzer):
1613

1714
def update(self):
1815
pass
1916

2017
def run(self):
21-
fname = str(self.filename).replace("/", "_").replace(" ", "_")
22-
# get the file to send
23-
binary = self.read_file_bytes()
24-
args = [f"@{fname}", "--json"]
25-
req_data = {
26-
"args": args,
27-
}
28-
req_files = {fname: binary}
29-
logger.info(
30-
f"Running {self.analyzer_name} on {self.filename} with args: {args}"
18+
logger.info(f"Running DIE on {self.filepath} for {self.md5}")
19+
20+
json_report = die.scan_file(
21+
self.filepath, die.ScanFlags.RESULT_AS_JSON, str(die.database_path / "db")
3122
)
32-
report = self._docker_run(req_data, req_files, analyzer_name=self.analyzer_name)
33-
if not report:
34-
self.report.errors.append("DIE did not detect the file type")
35-
return {}
36-
return report
23+
24+
return json.loads(json_report)
3725

3826
@staticmethod
3927
def mocked_docker_analyzer_get(*args, **kwargs):
4028
return MockUpResponse(
4129
{
42-
"report": {
43-
"arch": "NOEXEC",
44-
"mode": "Unknown",
45-
"type": "Unknown",
46-
"detects": [
47-
{
48-
"name": "Zip",
49-
"type": "archive",
50-
"string": "archive: Zip(2.0)[38.5%,1 file]",
51-
"options": "38.5%,1 file",
52-
"version": "2.0",
53-
}
54-
],
55-
"filetype": "Binary",
56-
"endianess": "LE",
57-
}
30+
"detects": [
31+
{
32+
"filetype": "PE64",
33+
"parentfilepart": "Header",
34+
"values": [
35+
{
36+
"info": "Console64,console",
37+
"name": "GNU linker ld (GNU Binutils)",
38+
"string": "Linker: GNU linker ld (GNU Binutils)(2.28)[Console64,console]",
39+
"type": "Linker",
40+
"version": "2.28",
41+
},
42+
{
43+
"info": "",
44+
"name": "MinGW",
45+
"string": "Compiler: MinGW",
46+
"type": "Compiler",
47+
"version": "",
48+
},
49+
{
50+
"info": "NRV,brute",
51+
"name": "UPX",
52+
"string": "Packer: UPX(4.24)[NRV,brute]",
53+
"type": "Packer",
54+
"version": "4.24",
55+
},
56+
],
57+
}
58+
]
5859
},
5960
200,
6061
)

0 commit comments

Comments
 (0)