Morpheus IOC Scanner is a tool designed to detect and analyze potentially malicious files, including ransomware and other Indicators of Compromise (IOCs). It uses custom-made rules to extract file-related information, alongside high-quality YARA rules that are widely used in enterprise environments to detect malware.
This tool is still in heavy development and is currently not ready to be used. Several updates are ongoing
-
VirusTotal Scan (API Key Required)
Submit a file or hash to VirusTotal for an in-depth analysis using multiple antivirus engines. This mode provides comprehensive information about potential threats using VirusTotal's extensive database. -
Default Scan (YARA/Pefile)
Perform a static scan using YARA rules and Pefile to identify common malicious patterns. This method can quickly flag suspicious files, including the custom detection of KRYPT0S, a ransomware developed as a proof of concept (POC).
To get started with Morpheus IOC Scanner, follow these steps:
- Install the required Python libraries:
pip install -r requirements.txt
- Set up the YARA database for Morpheus by running the setup file:
python3 setup.py
- Once setup is complete, you can run the main file (currently still in development, but the VirusTotal API feature is functional):
python3 morpheus_scanner.py
** Note: The VirusTotal integration is fully functional, while other features are still under development. **
-
Custom Detection for KRYPT0S Ransomware:
Includes tailored detection for the KRYPT0S ransomware POC. This project can be viewed here. -
High-Quality YARA Rules:
Uses enterprise-grade YARA rules to detect malware, allowing thorough and reliable scanning. -
File Information Extraction:
Extract detailed file-related information through custom-made rules designed for comprehensive file analysis. -
VirusTotal Integration:
Optionally integrate with VirusTotal to leverage multi-engine analysis for deeper insight into potential threats.
To use VirusTotal scanning:
- Sign up at VirusTotal: VirusTotal Sign Up
- Retrieve your API key from your profile under "API Key".
- Run the tool, choose the VirusTotal scan option, and paste your API key when prompted.
No additional setup is required for the default scan. Just run Morpheus IOC Scanner and choose the default scan option to analyze files with the built-in YARA rules and Pefile.