+
- 
- 
+
+
+
+ + Extract capabilities from executable files +
++ capa is the FLARE team's + free and open-source tool + to identify capabilities in executable files. + + + Triage unknown files, guide reverse engineering, and hunt across a corpus for novel malware. + Refer to capa's rule set as an encyclopedia of techniques used in real-world attacks, + pivoting across MITRE ATT&CK + and Malware Behavior Catalog (MBC) + references. +
+ +
Rules Crafted by Experts
++ capa recognizes behaviors by matching rules crafted by expert reverse engineers. +
+ Rules describe logical combinations of features familiar to human analysts. + Things like: +
+-
+
- API calls, like
CreateRemoteThread,
+ - integer constants, like
0x100000001b3 = FNV prime,
+ - string references, like
"ZIG_DEBUG_COLOR".
+
+ capa looks for these features within instructions, basic blocks, and functions, having already disassembled the input file. + In contrast to YARA, which primarily searches for sequences of bytes, capa rules describe features at the code-level. +
+
+ What's New
+ +Rule Updates
+ +-
+
+
- + added: + + overwrite DLL .text section to remove hooks + + + +
- + added: + + attach BPF to socket on Linux + + +
Tool Updates
+ +v7.2.0
+ ++ capa v7.2.0 + introduces a first version of capa explorer web: a web-based user interface to inspect capa results using your browser. + capa explorer web was worked on by @s-ff as part of a GSoC project, and it is available at https://mandiant.github.io/capa/explorer/. + This release also adds a feature extractor for output from the DRAKVUF sandbox. Now, analysts can pass the resulting drakmon.log file to capa and extract capabilities from the artifacts captured by the sandbox. +
+ +New features:
+-
+
- webui: explore capa analysis results in a web-based UI online and offline +
- support analyzing DRAKVUF traces +
- IDA extractor: extract names from dynamically resolved APIs stored in renamed global variables +
- cli: add the ability to select which specific functions or processes to analyze +
+ Integrates with Popular Reverse Engineering Tools +
++ + capa uses the results of static or dynamic analysis to find the capabilities of programs. + The tool can rely on many different analysis backends, including IDA, Ghidra, Binary Ninja, CAPE, DRAKVUF, and VMRay. + The capa Explorer plugins provide interfaces for understanding the behaviors in programs, directly within reverse engineering tools. +
++ IDA Pro +
++ + Use the capa Explorer IDA Plugin to guide your reverse engineering, zeroing in on the interesting functions by behavior. +
++ Ghidra +
++ + Invoke Ghidra in headless mode to collect features for capa, or use the capa Explorer Ghidra plugin to understand key functions. +
++ Binary Ninja +
++ + Use Binary Ninja as the disassembler backend, relying on its state-of-the-art code analysis to recover capabilities. +
++ CAPE +
++ + Analyze the API trace captured by CAPE as it detonates malware, summarizing the behaviors seen across thousands of function calls. +
++ Download capa +
++ We distribute capa as a standalone executable and as a Python library. +
+ ++ The standalone executable comes ready-to-go with 890+ embedded rules. + Use this when analyzing files from the terminal on Windows, Linux, and macOS. + There's a quickstart guide here (PDF). +
+ + + ++ capa is already included with malware analysis distributions like + FLARE-VM + and REmnux. +
+ ++ The Python library makes it easy to integrate capa into other projects, + like our plugins for IDA Pro and Ghidra. + Follow the + instructions here + , + which starts with installation it from PyPI like this: +
+ +pip install flare-capa+ Here's an example + of using capa as a library to process many files in parallel. +
+