In Malcat, hitting <Ctrl+M> will start the in-GUI MCP server (works in free version too). You can then interact with the current analysis using your LLM of choice.

Here I renamed functions and variables of the C2 dispatcher function for an unknown malware:

We're happy to announce that #malcat 0.9.13 is out!

You'll find a new Apple-silicon MacOS port, two integrated MCP servers (in-GUI +headless) for automated triage and an improved interface:

https://malcat.fr/blog/0913-is-out-macos-port-mcp-server-and-dark-mode

Sometimes, the absence of signature match is also interesting. Here the hashtag#Chrysalis sideloaded dll, where we can quickly spot the few interesting functions.

Make sure to check "Show UNK" !

A quick update on Malcat's MacOS development (apple silicon):

A couple of visual glitches, but the analysis & UI are now functional \o/

#malcat 0.9.12 is out!

Enjoy .pyc and .net stack analysis, py 3.14 support, nuitka / inno 6.7 / .net singlefile bundle parsers and may other improvements:

https://malcat.fr/blog/0912-is-out-python-314-pyc-and-net-stack-analysis/

#kesakode DB update to 1.0.48:

● new sigs: Crazyhunter, Echogather, IranBot, MaskGramStealer, PulsarRat and Themeforestrat
● 9 existing entries updated
● FP-fixed signatures: 82
● 1146 new clean programs whitelisted
● +527K unique functions
● +700K unique strings

#Malcat tip:

#Kesakode can be useful even when facing unknown/packed samples. Check "Show UNK" and focus on unique code and strings.

Here a simple downloader: