An automated malware analysis tool for Linux ELF files, extracting static and dynamic features for security assessment.
HaboMalHunter is an automated malware analysis tool specifically for Linux ELF files. It performs both static and dynamic analysis to extract security-relevant features like file dependencies, strings, process behavior, network activity, and system calls, helping analysts assess malware threats efficiently.
Security analysts, incident responders, and malware researchers who need to analyze Linux ELF malware in a controlled, automated environment.
It provides a comprehensive, open-source alternative to commercial malware analysis platforms, offering detailed JSON/HTML reports and integration with the broader Habo Malware Analysis System for streamlined threat assessment.
HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Extracts both static features (like ELF headers and strings) and dynamic behaviors (process, file I/O, network activity) as listed in the features, providing a holistic view of malware threats.
Produces JSON and HTML reports with clear sections for static and dynamic results, as shown in the screenshots, aiding in documentation and review.
As a sub-project of the Habo Malware Analysis System, it allows for online sample submission and customization, offering flexibility beyond proprietary tools.
Designed to run in a VirtualBox VM with Ubuntu 14.04 LTS, isolating malware execution to prevent system damage, as emphasized in the setup instructions.
Relies on Ubuntu 14.04 LTS (released in 2014) and VirtualBox 5.1, which are no longer supported, leading to potential security vulnerabilities and compatibility issues with newer systems.
Requires manual VM configuration, code compilation, and file copying steps, as detailed in the Demo section, making initial deployment time-consuming and error-prone.
Specifically for Linux ELF files on x86/x64; it generates error logs for non-executable files like .so and lacks support for other platforms, limiting its versatility.