Qu1cksc0pe

All-in-One malware analysis tool for analyze Windows, Linux, OSX binaries, Document files and APK files.

You can get:

• What DLL files are used.
• Functions and APIs.
• Sections and segments.
• URLs, IP addresses and emails.
• Android permissions.
• File extensions and their names.
  And so on...
  

Qu1cksc0pe aims to get even more information about suspicious files and helps user realize what that file is capable of.

Usage

python3 qu1cksc0pe.py --file suspicious_file --analyze

Screenshot

Updates

15/08/2022

• [X] DocumentAnalyzer module is upgraded. Now you can extract possible C2 domains from suspicious documents. (.doc and .docx)

Available On

Note

• [X] You can also use Qu1cksc0pe from Windows Subsystem Linux in Windows 10.

Setup

Necessary python modules:

• puremagic => Analyzing target OS and magic numbers.
• androguard => Analyzing APK files.
• apkid => Check for Obfuscators, Anti-Disassembly, Anti-VM and Anti-Debug.
• rich => Pretty outputs and TUI.
• tqdm => Progressbar animation.
• colorama => Colored outputs.
• oletools => Analyzing VBA Macros.
• pefile => Gathering all information from PE files.
• quark-engine => Extracting IP addresses and URLs from APK files.
• pyaxmlparser => Gathering informations from target APK files.
• yara-python => Android library scanning with Yara rules.
• prompt_toolkit => Interactive shell.
• frida => Performing dynamic analysis against android applications.
• lief => ELF binary parsing and analysis.
• zepu1chr3 => Analyzing binaries via radare2.
• pygore => Analyzing golang binaries```
• qiling => Dynamic analysis of binaries.

Installation of python modules: pip3 install -r requirements.txt
Gathering other dependencies:

• VirusTotal API Key: https://virustotal.com
• Strings: sudo apt-get install strings
• PyExifTool: git clone git://github.com/smarnach/pyexiftool.git then cd pyexiftool && sudo python3 setup.py install

Alert

You must specify jadx binary path in Systems/Android/libScanner.conf

[Rule_PATH]
rulepath = /Systems/Android/YaraRules/

[Decompiler]
decompiler = JADX_BINARY_PATH <-- You must specify this.

Installation

• [X] You can install Qu1cksc0pe easily on your system. Just execute the following commands.
  Command 0: sudo pip3 install -r requirements.txt
  Command 1: sudo python3 qu1cksc0pe.py --install

Static Analysis

Normal analysis

Usage: python3 qu1cksc0pe.py --file suspicious_file --analyze

Resource analysis

Usage: python3 qu1cksc0pe.py --file suspicious_file --resource

Hash scan

Usage: python3 qu1cksc0pe.py --file suspicious_file --hashscan

Folder scan

Supported Arguments:

• --hashscan
• --packer

Usage: python3 qu1cksc0pe.py --folder FOLDER --hashscan

VirusTotal

Report Contents:

• Threat Categories
• Detections
• CrowdSourced IDS Reports

Usage for --vtFile: python3 qu1cksc0pe.py --file suspicious_file --vtFile

Document scan

Usage: python3 qu1cksc0pe.py --file suspicious_document --docs

File signature analyzer

Usage: python3 qu1cksc0pe.py --file suspicious_file --sigcheck

File Carving

MITRE ATT&CK Technique Extraction

Usage: python3 qu1cksc0pe.py --file suspicious_file --mitre

Programming language detection

Usage: python3 qu1cksc0pe.py --file suspicious_executable --lang

Interactive shell

Usage: python3 qu1cksc0pe.py --console

Dynamic Analysis

Dynamic instrumentation with FRIDA scripts (for android applications)

Alert

You must connect a virtual device or physical device to your computer.

Usage: python3 qu1cksc0pe.py --runtime

Binary Emulation

Alert

Binary emulator is not recommended for .NET analysis.

Usage: python3 qu1cksc0pe.py --file suspicious_file --watch

Informations about categories

Registry

This category contains functions and strings about:

• Creating or destroying registry keys.
• Changing registry keys and logs.

File

This category contains functions and strings about:

• Creating/modifying/infecting/deleting files.
• Getting information about file contents and filesystems.

Networking/Web

This category contains functions and strings about:

• Communicating with malicious hosts.
• Downloading malicious files.
• Sending informations about infected machine and its user.

Process

This category contains functions and strings about:

• Creating/infecting/terminating processes.
• Manipulating processes.

Dll/Resource Handling

This category contains functions and strings about:

• Handling DLL files and another malware's resource files.
• Infecting and manipulating DLL files.

Evasion/Bypassing

This category contains functions and strings about:

• Manipulating Windows security policies and bypassing restrictions.
• Detecting debuggers and doing evasive tricks.

System/Persistence

This category contains functions and strings about:

• Executing system commands.
• Manipulating system files and system options to get persistence in target systems.

COMObject

This category contains functions and strings about:

• Microsoft's Component Object Model system.

Cryptography

This category contains functions and strings about:

• Encrypting and decrypting files.
• Creating and destroying hashes.

Information Gathering

This category contains functions and strings about:

• Gathering informations from target hosts like process states, network devices etc.

Keyboard/Keylogging

This category contains functions and strings about:

• Tracking infected machine's keyboard.
• Gathering information about targets keyboard.
• Managing input methods etc.

Memory Management

This category contains functions and strings about:

• Manipulating and using target machines memory.

Thanks to

For most of FRIDA scripts: https://github.com/Ch0pin/
Another scripts: https://codeshare.frida.re/browse