password123456 / malwarescanner Goto Github PK

Simple Malware Scanner written in python

License: GNU General Public License v2.0

Python 100.00%

malware-scanner security-scanner antivirus file-scanner virus owasp malware-detection malware-analyzer security-tools scanner

malwarescanner's Introduction

MalwareScanner

Very basic malware Scanner by hash comparison
Sometimes this can be needed when an incident response.
If you found new or suspicious files when you do response, you want to check out where these files exist in systems. so then you may need like this tool. this is a demo version. not complete. you have to change and modify code and make it yours.
Let me know if there are any changes required or additional features need it.
and press the "stars" if it helps. then it will continue to improvement.

Features

File inspection based on hash (free malware hashes)
Scanning include subdirectories
Multithreading Jobs
Define file extensions to scan
Define directories not to scan
Easy to attach scan_logs to the SIEM (e.g Splunk)
Easy to Handle and changeable code/function structure (if you interest)

v1.0.5

https://github.com/password123456/malwarescanner/blob/main/CHANGES

Preview

Scan result_log

datetime, scan_id, os, hostname, ip, file.........hash,

datetime="2022-12-23 13:52:45",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\chrome.exe",sha256="45de9f5a25bf478c6a8d8625a984895c9b3fdea6eb12a55ddd088dcebd9df5ab",created_at="2022-05-02 21:33:38",modified_at="2022-04-14 06:17:04"
datetime="2022-12-23 13:52:46",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\LineLauncher.exe",sha256="60fd9ceac8d1c40e835d3dc9aa77599d3f810a646199ecbdcb8003521ce7d502",created_at="2022-05-10 12:38:18",modified_at="2022-03-10 18:00:10"
datetime="2022-12-23 13:52:46",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\LineUpdater.exe",sha256="6b663f9f7bf3b6c1a2ce898b2402b691fff6dced36e9b0196e152bbfc409db42",created_at="2022-05-10 12:38:22",modified_at="2022-04-06 10:06:28"
datetime="2022-12-23 13:52:47",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\PCHunter32.exe",sha256="0544b99c52d607712d70351c6d9afb1fba6adb0de256baf662f06fdf6058aa3d",created_at="2022-05-10 11:36:04",modified_at="2017-08-14 02:27:08"
datetime="2022-12-23 13:52:48",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\report.xlsx",sha256="dd1dc1cb4ffa3e1b91f00496436416807f6153d53ac45e67ce1287c842bd5e3e",created_at="2022-04-27 23:53:33",modified_at="2021-09-07 10:52:40"
datetime="2022-12-23 13:52:48",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\TWOD_Launcher.exe",sha256="1d55ab0a703f2b8f5cc0d3cc93bedf7c03799b2b3e42defc83c175da8a125962",created_at="2022-04-27 23:54:50",modified_at="2022-04-07 09:14:08"
datetime="2022-12-23 13:52:49",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\unins000.exe",sha256="2da3b504c2b68219c0b4c6f062867dae091560c3f1e0735f1a7b17b1d79b5a90",created_at="2022-04-27 23:54:53",modified_at="2022-04-26 12:19:01"
datetime="2022-12-23 13:52:49",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\vmware-view.exe",sha256="17b21902170784d460fd0168e08f6e2075d6eb0a501093bc35184c550d73b5d8",created_at="2022-05-10 12:38:38",modified_at="2020-07-07 18:08:06"

malwarescanner's People

Contributors

Stargazers

Watchers

malwarescanner's Issues

infected files

shows errors i donot know why when I use any Sha infected files

can't install (module "magic" not found)

OS and Python versoin

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 22.04 LTS
Release:	22.04
Codename:	jammy
$ python --version
Python 3.10.4

steps to reproduce:

download doce as zip
unpack
cd relative_path/malwarescanner
create virtual environment

virtualenv venv
source venv/bin/activate

installation

$ pip install -r requirements.txt 
Collecting requests
  Using cached requests-2.27.1-py2.py3-none-any.whl (63 kB)
Collecting python-magic
  Using cached python_magic-0.4.26-py2.py3-none-any.whl (13 kB)
ERROR: Could not find a version that satisfies the requirement python-magic-bin (from versions: none)
ERROR: No matching distribution found for python-magic-bin
$ pip install python-magic-bin
pip install pip install python-magic-bin
ERROR: Could not find a version that satisfies the requirement pip install python-magic-bin (from versions: none)
ERROR: No matching distribution found for pip install python-magic-bin

try istall requirements "step-by-step"

$ python main_v1.0.3-220510.py --help
Traceback (most recent call last):
  File "main_v1.0.3-220510.py", line 8, in <module>
    import requests
ModuleNotFoundError: No module named 'requests'
$ pip install requests
Collecting requests
  Using cached requests-2.27.1-py2.py3-none-any.whl (63 kB)
Collecting charset-normalizer~=2.0.0
  Using cached charset_normalizer-2.0.12-py3-none-any.whl (39 kB)
Collecting idna<4,>=2.5
  Using cached idna-3.3-py3-none-any.whl (61 kB)
Collecting certifi>=2017.4.17
  Downloading certifi-2022.5.18.1-py3-none-any.whl (155 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 155.2/155.2 kB 2.7 MB/s eta 0:00:00
Collecting urllib3<1.27,>=1.21.1
  Using cached urllib3-1.26.9-py2.py3-none-any.whl (138 kB)
Installing collected packages: urllib3, idna, charset-normalizer, certifi, requests
Successfully installed certifi-2022.5.18.1 charset-normalizer-2.0.12 idna-3.3 requests-2.27.1 urllib3-1.26.9
$ python main_v1.0.3-220510.py --help
Traceback (most recent call last):
  File "main_v1.0.3-220510.py", line 10, in <module>
    import magic
ModuleNotFoundError: No module named 'magic'
$ pip install magic
ERROR: Could not find a version that satisfies the requirement magic (from versions: none)
ERROR: No matching distribution found for magic

Please, fix it.

Hello, this is a great piece of software. I have a problem when running it. It will stop working when it encounters a symbolic link on a Linux system, even if the symlink is good. I'm not sure how to handle file descriptors, perhaps you can find a way?

`- 72054 files scanned / 0 infected [06:07:08] (/home/tuxertech/.local/share/Steam/steamapps/common/SteamLinuxRuntime_soldier/soldier_0.20201022.1/files/lib/python3.7/numbers.py) Traceback (most recent call last):l)
File "/data/source/src/malwarescanner/./main.py", line 382, in
main()
File "/data/source/src/malwarescanner/./main.py", line 364, in main
scanner(_scan_path)
File "/data/source/src/malwarescanner/./main.py", line 307, in scanner
if check_file_size(_f_name):
File "/data/source/src/malwarescanner/./main.py", line 205, in check_file_size
f = os.stat(_file_name).st_size
FileNotFoundError: [Errno 2] No such file or directory: '/home/tuxertech/.local/share/Steam/steamapps/common/SteamLinuxRuntime_soldier/soldier_0.20201022.1/files/lib/python3.7/sitecustomize.py'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/data/source/src/malwarescanner/./main.py", line 386, in
print('%s- ::Exception:: Func:[%s] Line:[%s] [%s] %s%s' % (Bcolors.Yellow, name.name, sys.exc_info()[-1].tb_lineno, type(e).name, e, Bcolors.Endc))
AttributeError: 'str' object has no attribute 'name'. Did you mean: 'ne'?

% ls -l sitecustomize.py
lrwxrwxrwx 1 tuxertech users 31 Jul 25 2020 sitecustomize.py -> /etc/python3.7/sitecustomize.py
`

password123456 / malwarescanner Goto Github PK

malwarescanner's Introduction

MalwareScanner

Features

v1.0.5

Preview

Scan result_log

malwarescanner's People

Contributors

Stargazers

Watchers

Forkers

malwarescanner's Issues

infected files

can't install (module "magic" not found)

OS and Python versoin

steps to reproduce:

crash on symlink

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent