capa
#Security Testing#Malware Analysis
A malware/botnet analysis framework with a focus on network analysis and process comparison.
Capa Detects Capabilities in Executable Files
Capa identifies capabilities in executable files by examining PE, ELF, .NET modules, shellcode files, or sandbox reports. This analysis helps to uncover potential behaviors, such as backdoors, service installations, or communication methods like HTTP. For further details, explore our capa blog posts: Dynamic capa: Exploring Executable Run-Time Behavior with the CAPE Sandbox, capa v4: casting a wider .NET (.NET support), ELFant in the Room – capa v3 (ELF support), capa 2.0: Better, Stronger, Faster, and capa: Automatically Identify Malware Capabilities. To use it, run the command: $ capa.exe suspicious.exe. ATT&CK Tactic and Technique mapping is also available.
