karton - Distributed malware processing framework based on

项目说明

Karton <img src="img/logo.svg" width="64">

Distributed malware processing framework based on Python, Redis and S3.

The idea

Karton is a robust framework for creating flexible and lightweight malware analysis backends.
It can be used to connect malware* analysis systems into a robust pipeline with very little effort.

We've been in the automation business for a long time. We're dealing with more and more threats, and we have to automate e to keep up with incidents. Because of this, we often end up with many scripts stuck together with ~~duck~~ duct tape and WD-40. These scripts are written by analysts in the heat of the moment, fragile and ugly - but they work, and produce intel that must be stored, processed further, sent to other systems or shared with other organisations.

We needed a way to take our PoC scripts and easily insert them into our analysis pipeline. We also wanted to monitor their execution, centralise logging, impro, reduce de inertia... For this exact purpose, we created Karton.

*\* while Karton was designed with malware analysis in mind, it works nicely in every microser project.*

Installation

Installation is as easy as a single pip install command:

In order to setup the whole backend en you will also need S3-compatible storage and Redis, see the docs for details.

Example usage

Command line

This package also provies a command-line utility called "karton". You can use it for simple management tasks (but it's not designed as a fully capable management tool).

Karton systems

Some Karton systems are uni and useful to e. We decided to share them with the community.

#### karton
This repository. It contains the karton.system service - main service, responsible for dispatching tasks within the system. It also contains the karton.core module, that is used as a library by other systems.

#### karton-dashboard
A small Flask dashboard for task and queue management and monitoring.

#### karton-classifier
The "router". It recognises samples/files and produces task types depending on the file format. Thanks to this, other systems may only listen for tasks with a specific format (for example, only zip archives).

#### karton-archi
Generic archi. Archi into the system will be extracted, and every file will be processed indi.

#### karton-config-extractor
Malware extractor. It uses Yara rules and Python modules to extract static configuration from malware samples and analyses. It's a fishing rod, not a fish - we don't share the modules themselves. But it's easy to write your own!

#### karton-mwdb-reporter
A very important part of the pipeline. Reporter submits all files, tags, comments and other intel produced during the analysis to MWDB. If you don't use MWDB yet or just prefer other backends, it's easy to write your own reporter.

#### karton-yaramatcher
Automatically runs Yara rules on all files in the pipeline, and tags samples appropriately. Rules not included ;).

#### karton-asciimagic
Karton system that decodes files encoded with common methods, like hex, base64, etc. (You wouldn't believe how common it is).

#### karton-autoit-ripper
A small wrapper around AutoIt-Ripper that extracts embedded AutoIt scripts and resources from compiled AutoIt executables.

#### DRAK
Automated black-box malware analysis system with DRAK under the hood, which does not require an agent on guest OS.

---

This is how these systems can be used to form a basic malware analysis pipeline:

Community projects that incorporate the Karton framework

#### c3rb3ru5d3d53c/karton-unpacker
A modular Karton Framework service that unpacks common packers like UPX and others using the Qiling Framework.

#### c3rb3ru5d3d53c/mwcfg / c3rb3ru5d3d53c/mwcfg-modules
A Feature Rich Modular Malware Configuration Extraction Utility for MalDuck

#### raw-data/karton-die-classifier
Detect-It-Easy classifier for the Karton framework

#### raw-data/karton-retdec-unpacker
RetDec unpacker module for the Karton framework

#### W3ndige/aurora / W3ndige/karton-similarity
Malware similarity platform with modularity in mind.

#### splintersfury/dri
A scalable Windows dri analyzer pipeline.

!Co-financed by the Connecting Europe Facility by of the European Union

项目信息

开发语言：Python

Star 数：479

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Distributed malware processing framework based on Python, Redis and S3.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。