base64_substring
#Security Testing#Malware Analysis
Krakatau provides an assembler and disassembler for Java bytecode, supporting conversion, creation, examination, comparison, and decompilation of Java binaries.
The base64_substring Tool Assists Malware Analysts
The base64_substring tool assists malware analysts in searching through base64-encoded samples. It does this by enumerating all possible base64 encodings for a specified search term and generating a yara rule that checks these possibilities. For example, you can create a yara rule that matches a base64-encoded file containing the term 'Application' by using the provided script. For further information, refer to 'Searching for Content in Base-64 Strings' by Lee Holmes.
