AIL-framework
AIL-framework copied to clipboard
Malware configuration automatic parsing
Hi,
We have already seen some malware configurations in Pastebin like trickbot (Sample: https://pastebin.com/gK9gL0kF). It could be cool to parse it and push it to another tools like MISP.
There's other tools that do malware config extraction like CAPE (https://github.com/ctxis/CAPE).
Probably makes more sense to add a module that can send data to an external system like CAPE, since AIL is more data collection and processing tool imho.