Elastic Security Labs - nightMARE
This directory contains the nightMARE (Malware Analysis & Reverse Engineering) library. nightMARE is a central module that will allow for an efficient and logical approach to automating various reverse engineering functions.
The nightMARE library is born from the need to refactor our code base into reusable bricks. We want to concentrate logics and dependencies into a single library in order to speed up tool developement for members of the Elastic Security Labs team.
By open sourcing our library to the community we hope that it'll contribute to our battle against threats.
Please note that this library is still young and under developement. Pull requests are welcome.
Example usage: https://www.elastic.co/security-labs/unpacking-icedid
Malware modules
| Module | Description |
|---|---|
nightmare.malware.blister |
Implement BLISTER algorithms |
nightmare.malware.ghostpulse |
Implement GHOSTPULSE algorithms |
nightmare.malware.deprecated.icedid |
Implement ICEDID algorithms (deprecated) |
nightmare.malware.latrodectus |
Implement LATRODECTUS algorithms |
nightmare.malware.lobshot |
Implement LOBSHOT algorithms |
nightmare.malware.lumma |
Implement LUMMA algorithms |
nightmare.malware.netwire |
Implement NETWIRE algorithms |
nightmare.malware.redlinestealer |
Implement REDLINESTEALER algorithms |
nightmare.malware.remcos |
Implement REMCOS algorithms |
nightmare.malware.smokeloader |
Implement SMOKELOADER algorithms |
nightmare.malware.stealc |
Implement STEALC algorithms |
nightmare.malware.vidar |
Implement VIDAR algorithms |
nightmare.malware.warmcookie |
Implement WARMCOOKIE algorithms |
nightmare.malware.xorddos |
Implement XORDDOS algorithms |
Requirements
- Python >=
3.10is required. - Rizin v0.8.1 must be installed and available in the system's PATH environment variable.
Install
pip install nightmare-lib
or
git clone https://github.com/elastic/nightMARE
python -m pip install ./nightMARE
Test
Download the corpus from here and place the archive in the tests folder to run the tests. Warning: The archive contains malware; testing should be performed in a virtual machine for safety.
py.test
How to Contribute
Contributors must sign a Contributor License Agreement before contributing code to any Elastic repositories.
License
nightMARE uses the Elastic License version 2.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file nightmare_lib-0.18.0.tar.gz.
File metadata
- Download URL: nightmare_lib-0.18.0.tar.gz
- Upload date:
- Size: 61.4 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/6.2.0 CPython/3.14.6
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
0d361fe60f8fb251d6f1b660abd73d6fae27ab6e929b2e6eec21215a7e1eab58
|
|
| MD5 |
6174ec2a0515ad769d262e40970e80e2
|
|
| BLAKE2b-256 |
9ee5cef41ede7eddc52e30a2083b2f8aebeabfdb8868af46192ca6f16743d142
|
File details
Details for the file nightmare_lib-0.18.0-py3-none-any.whl.
File metadata
- Download URL: nightmare_lib-0.18.0-py3-none-any.whl
- Upload date:
- Size: 84.8 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/6.2.0 CPython/3.14.6
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
bbd99c7946baf025be5e8935490c0d6779dae43a65fa23131864b695ffe018bc
|
|
| MD5 |
d3654be8082d6f8a613cf69487d3e775
|
|
| BLAKE2b-256 |
d00e383e44f33211399f16f36ecca976c930bb3e8b9d4f20c2c888c7ada9abab
|
