nukib/maldump

Multi-quarantine extractor

maldump

Maldump makes it easy to extract quarantined files of multiple AVs from a live system or a mounted disk image.

Features

Supports extraction from the following AV products

• Avast Antivirus
• Avira Antivirus
• Eset NOD32
• FortiClient
• G Data
• Kaspersky for Windows Server
• Malwarebytes
• Microsoft Defender
• McAfee
• AVG

Installation

Using pip (Recommended)

$ pip install maldump

Or alternatively using git and Virtual Environment

$ git clone https://github.com/NUKIB/maldump
$ cd maldump

Create new environment and activate it

$ python3 -m venv venv
$ . venv/bin/activate

Install dependencies

(env) $ pip install -r requirements.txt

Run it as a module

(env) $ python3 -m maldump

Usage

usage: maldump [-h] [-l] [-q] [-m] [-a] [-v] root_dir

Multi-quarantine extractor

positional arguments:
  root_dir       root directory where OS is installed (example C:\)

optional arguments:
  -h, --help     show this help message and exit
  -l, --list     list quarantined file(s) to stdout (default action)
  -q, --quar     dump quarantined file(s) to archive 'quarantine.tar'
  -m, --meta     dump metadata to CSV file 'quarantine.csv'
  -a, --all      equivalent of running both -q and -m
  -v, --version  show program's version number and exit
  -d, --dest     destination for exported files

Examples

On Windows

List quarantine files located on disk C

$ maldump C:\

Dump quarantine files from disk C into archive quarantine.tar

$ maldump C:\ --quar

Export quarantine metadata from disk C into quarantine.csv

$ maldump C:\ --meta

Export both files and metadata from a mounted disk F

$ maldump F:\ --all

On Linux

List quarantine files from a windows partition mounted on /mnt/win

$ maldump /mnt/win

Disclaimer

Keep in mind, all timestamps are in UTC except for "Kaspersky for Windows Server" which stores timestamps in a local timezone.

For optimal results, admin privileges are required when running on Windows system. Linux does not require admin rights.

Contributing

To contribute to this project, please follow the CONTRIBUTING.

License

This software is licensed under GNU General Public License version 3.

• Copyright (C) 2022 National Cyber and Information Security Agency of the Czech Republic (NÚKIB)

maldump's Issues

Add text summary - add information to output

Is your feature request related to a problem? Please describe.
After the tool is used, it would be nice to get info such as folders scanned, number of found logs, etc. This would help with possible issues and, in general, better info about what is happening.

Describe the solution you'd like
There would be some summary line with relevant information so analysts can see what was touched by Maldump and what the results were. E.g. scanned folders: 3 Relevant log files: 10/1000.

Describe alternatives you've considered
Add this as an optional argument "-v".

Additional context
During testing of the tool, no relevant info was displayed (when nothing was found) so it would be nice to make it more interactive.

ModuleNotFoundError

Describe the bug
In newest version 0.3.0 maldump can not find module maldump.parsers.kaitai. Version 0.2.0 does not have this problem. I have kaitaistruct installed.

To Reproduce
Steps to reproduce the behavior:

1. pip install maldump
2. Run any maldump command
3. Stack Trace
   Traceback (most recent call last):
   File "<frozen runpy>", line 198, in run_module_as_main
   File "<frozen runpy>", line 88, in run_code
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Scripts\maldump.exe_main.py", line 4, in <module>
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Lib\site-packages\maldump_main.py", line 17, in <module>
   from maldump.av_manager import AVManager
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Lib\site-packages\maldump\av_manager.py", line 5, in <module>
   from maldump.avs import (avast, avg, avira, eset, forticlient, gdata,
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Lib\site-packages\maldump\avs\avira.py", line 6, in <module>
   from maldump.parsers.avira_parser import AviraParser
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Lib\site-packages\maldump\parsers\avira_parser.py", line 5, in <module>
   from maldump.parsers.kaitai.avira_parser import AviraParser as KaitaiParser
   ModuleNotFoundError: No module named 'maldump.parsers.kaitai'

Expected behavior
No errors.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: Windows

Portable Binary (Pyinstaller)

Hello !

I'm very interested at this project !
I would like to make an executable using Pyinstaller in order to forensically extract quarantines files on computers without Python installed.
Do you think it is possible ?

Thank you so much !