pegasus-malware-scan

Description

Pegasus Malware Scan is a comprehensive cybersecurity solution designed for advanced threat detection and malware analysis. Built with Python, this powerful tool employs multi-layered detection techniques to identify and neutralize a wide range of malicious software, from common viruses to sophisticated advanced persistent threats (APTs).

What is Pegasus Malware Scan?

Pegasus Malware Scan represents the next generation of malware detection tools, combining traditional hash-based verification with modern behavioral analysis and machine learning capabilities. Unlike conventional antivirus solutions that rely primarily on signature-based detection, Pegasus implements a hybrid approach that can identify both known threats and previously undiscovered malware through anomaly detection.

Key Advantages

• Lightweight but Powerful: Optimized code ensures minimal system resource usage while maintaining comprehensive protection
• Multi-layered Detection: Combines multiple detection methods for maximum effectiveness against diverse threats
• Enterprise-Ready: Scales from individual systems to large organizational deployments with centralized management
• Customizable: Highly configurable to meet specific security requirements across different environments
• Open Architecture: Designed for integration with existing security infrastructure and tools

Use Cases

• Incident Response: Rapidly scan systems during active security incidents to identify malware presence
• Digital Forensics: Analyze suspicious files and systems to gather evidence for security investigations
• System Hardening: Perform comprehensive scans to ensure system integrity before deployment
• Continuous Monitoring: Implement ongoing protection against evolving threats in critical systems
• Security Research: Aid in malware analysis and research with detailed scanning capabilities

Technical Specifications

• Language: Built with Python 3.6+ for cross-platform compatibility
• Database: Uses optimized NoSQL databases for threat intelligence storage
• System Requirements:
  • Minimum: 2GB RAM, 500MB disk space, single-core processor
  • Recommended: 4GB RAM, 1GB disk space, multi-core processor
• Platforms Support: Windows, macOS, Linux (Ubuntu, CentOS, Debian)
• API Integration: RESTful API for integration with other security tools
• Containers: Docker support for easy deployment and scaling

System Architecture

Pegasus Malware Scan employs a modular architecture consisting of several core components:

1. Scanning Engine: The primary component responsible for file analysis using various detection methods
2. Threat Intelligence Module: Maintains an updated database of known threats and indicators of compromise
3. Behavioral Analysis Subsystem: Executes and monitors suspicious files in a sandboxed environment
4. Reporting & Alerting System: Generates detailed reports and sends notifications about detected threats
5. Management Console: Provides a unified interface for configuration and monitoring
6. Integration Layer: Facilitates communication with external systems and security tools

The modular design allows for easy updates and extensions of functionality without requiring changes to the core system.

Deployment Scenarios

Pegasus Malware Scan supports multiple deployment scenarios to accommodate different organizational needs:

• Standalone Deployment: Install directly on individual endpoints for independent protection
• Client-Server Model: Central management server with lightweight agents deployed on endpoints
• Cloud-Based Deployment: SaaS model with cloud-hosted management and analytics
• Hybrid Deployment: Combination of on-premises and cloud components for optimal performance
• Air-Gapped Networks: Special deployment options for isolated high-security environments

Security Compliance & Standards

Pegasus Malware Scan is designed to help organizations meet security compliance requirements across multiple frameworks:

• Supports compliance with GDPR, HIPAA, PCI DSS, and NIST Cybersecurity Framework
• Follows OWASP security best practices for secure development
• Implements proper data handling practices for sensitive information
• Provides audit trails suitable for compliance reporting
• Regularly updated to address emerging security standards

Original Project Notes

• Very basic malware Scanner by hash comparison
• Sometimes this can be needed when an incident response.
• If you found new or suspicious files when you do response, you want to check out where these files exist in systems. so then you may need like this tool. this is a demo version. not complete. you have to change and modify code and make it yours.
• Let me know if there are any changes required or additional features need it.
• and press the "stars" if it helps. then it will continue to improvement.

Author

• Letda Kes dr. Muhammad Sobri Maulana, S.Kom, CEH, OSCP, OSCE
• GitHub: github.com/sobri3195
• Contact: [email protected]

Donation

Support this project: https://lynk.id/muhsobrimaulana

Features

Core Scanning Capabilities

• File inspection based on hash (free malware hashes): Utilizes free malware hash databases to identify known malicious files by comparing their cryptographic hashes without requiring signature-based detection.
• Scanning include subdirectories: Automatically traverses and scans all subdirectories within the target path for comprehensive coverage of file systems.
• Multithreading Jobs: Employs parallel processing to scan multiple files simultaneously, significantly reducing total scan time on systems with multiple cores.
• Define file extensions to scan: Allows users to customize which file types are scanned, focusing resources on potentially executable or dangerous file formats.
• Define directories not to scan: Enables exclusion of specific directories to prevent scanning in sensitive areas or to improve performance.

Integration & Reporting

• Easy to attach scan_logs to the SIEM (e.g Splunk): Generates logs in a format that can be directly ingested by Security Information and Event Management systems for centralized monitoring.
• Export scan results in multiple formats (CSV, JSON, XML): Supports various export formats for integration with different analysis tools and reporting systems.
• Email notifications for detected threats: Automatically sends alerts when malicious files are discovered, ensuring immediate awareness of security incidents.
• Detailed threat analytics and reporting dashboard: Provides comprehensive visualizations and metrics on scan results, threat distributions, and system security status.

Advanced Detection Features

• Real-time scanning capability for active monitoring: Continuously monitors file system activities to detect threats as they appear without waiting for scheduled scans.
• Integration with cloud-based threat intelligence platforms: Connects to external threat intelligence services to enhance detection capabilities with up-to-date information.
• Behavioral analysis of suspicious files: Examines how files behave when executed in a controlled environment to identify malicious patterns that static analysis might miss.
• Sandbox execution for unknown files: Runs suspicious files in an isolated environment to safely observe their behavior and determine if they're malicious.
• Memory scanning for fileless malware detection: Identifies malware that operates solely in memory without writing files to disk, detecting advanced threats that evade traditional scanning.
• Registry scanning for Windows systems: Examines the Windows registry for suspicious entries that could indicate malware persistence mechanisms.
• Malware family identification and classification: Categorizes detected malware into families to provide context about the threat, its capabilities, and potential impacts.

Management Features

• Easy to Handle and changeable code/function structure: Designed with modular architecture allowing for easy customization and extension of functionality.
• Scheduled scanning with customizable frequency: Allows users to set up recurring scans at preferred intervals (hourly, daily, weekly) to maintain system security.
• Remote scanning of networked devices: Extends scanning capabilities across the network to protect all connected devices from a central management point.
• USB device scanning and monitoring: Automatically detects and scans USB devices when connected to prevent malware introduction through removable media.
• System quarantine capabilities for infected files: Safely isolates detected malware to prevent execution and spread while allowing for further analysis.
• Customizable scan policies and threat response actions: Enables administrators to define how the system responds to different threat types, from alerting to automatic remediation.

v1.0.5

• https://github.com/sobri3195/pegasus-malware-scan/blob/main/CHANGES

Preview

Scan result_log

• datetime, scan_id, os, hostname, ip, file.........hash,

datetime="2022-12-23 13:52:45",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\chrome.exe",sha256="45de9f5a25bf478c6a8d8625a984895c9b3fdea6eb12a55ddd088dcebd9df5ab",created_at="2022-05-02 21:33:38",modified_at="2022-04-14 06:17:04"
datetime="2022-12-23 13:52:46",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\LineLauncher.exe",sha256="60fd9ceac8d1c40e835d3dc9aa77599d3f810a646199ecbdcb8003521ce7d502",created_at="2022-05-10 12:38:18",modified_at="2022-03-10 18:00:10"
datetime="2022-12-23 13:52:46",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\LineUpdater.exe",sha256="6b663f9f7bf3b6c1a2ce898b2402b691fff6dced36e9b0196e152bbfc409db42",created_at="2022-05-10 12:38:22",modified_at="2022-04-06 10:06:28"
datetime="2022-12-23 13:52:47",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\PCHunter32.exe",sha256="0544b99c52d607712d70351c6d9afb1fba6adb0de256baf662f06fdf6058aa3d",created_at="2022-05-10 11:36:04",modified_at="2017-08-14 02:27:08"
datetime="2022-12-23 13:52:48",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\report.xlsx",sha256="dd1dc1cb4ffa3e1b91f00496436416807f6153d53ac45e67ce1287c842bd5e3e",created_at="2022-04-27 23:53:33",modified_at="2021-09-07 10:52:40"
datetime="2022-12-23 13:52:48",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\TWOD_Launcher.exe",sha256="1d55ab0a703f2b8f5cc0d3cc93bedf7c03799b2b3e42defc83c175da8a125962",created_at="2022-04-27 23:54:50",modified_at="2022-04-07 09:14:08"
datetime="2022-12-23 13:52:49",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\unins000.exe",sha256="2da3b504c2b68219c0b4c6f062867dae091560c3f1e0735f1a7b17b1d79b5a90",created_at="2022-04-27 23:54:53",modified_at="2022-04-26 12:19:01"
datetime="2022-12-23 13:52:49",scan_id="4d7f0b1b-f771-4dd0-bb87-6453ff6341e8",os="Windows",hostname="DESKTOP-S5VJGLH",ip="192.168.0.23",infected_file="F:\code\pythonProject\malware_hash_scanner3\scan_test_dir\vmware-view.exe",sha256="17b21902170784d460fd0168e08f6e2075d6eb0a501093bc35184c550d73b5d8",created_at="2022-05-10 12:38:38",modified_at="2020-07-07 18:08:06"