saferwall
Saferwall is an open source malware analysis platform.
It aims for the following goals:
- Provide a collaborative platform to share samples among malware researchers.
- Acts as a system expert, to help researchers generates an automated malware analysis report.
- Hunting platform to find new malwares.
- Quality ensurance for signatures before releasing.

Features
-
Static analysis:
- Crypto hashes, packer identification,
- Strings extraction
- Portable Executable file parser
-
Multiple AV scanner which includes major antivirus vendors:
Vendors status Vendors status Avast :heavy_check_mark: FSecure :heavy_check_mark: Avira :heavy_check_mark: Kaspersky :heavy_check_mark: Bitdefender :heavy_check_mark: McAfee :heavy_check_mark: ClamAV :heavy_check_mark: Sophos :heavy_check_mark: Comodo :heavy_check_mark: Symantec :heavy_check_mark: ESET :heavy_check_mark: Windows Defender :heavy_check_mark: TrendMicro :heavy_check_mark: DrWeb :heavy_check_mark:
Current architecture / Workflow:

Here is a basic workflow which happens during a file scan:
- Frontend talks to the the backend via REST APIs.
- Backend uploads samples to the object storage.
- Backend pushes a message into the scanning queue.
- Consumer fetches the file and copy it into to the nfs share avoiding to pull the sample on every container.
- Consumer calls asynchronously scanning services (like AV scanners) via gRPC calls and waits for results.