🛡️ Defuse

Automated Malware Discovery, C2 Indicator Extraction & Threat Remediation Tool

Defuse is a lightweight, modular cybersecurity automation framework developed in Python for malware response and threat eradication inside Virtual Machine. Given only a malware filename or name stem (e.g. mal-track or maltrack), Defuse automatically discovers the binary payload, extracts Command & Control (C2) IPv4 indicators, terminates active malware processes safely, strips autostart registry persistence, deletes malicious file copies, and cleans up empty directories left behind.

---

✨ Key Features

• 🔍 Targeted Malware Discovery: Automatically scans common malware drop paths (Desktop, Documents, Downloads, AppData, Temp, Startup) to locate the payload by normalized filename or stem.
• 🌐 C2 IP Extraction: Parses raw ASCII and UTF-16LE binary strings without external utilities to extract valid C2 IPv4 addresses (filtering out invalid or broadcast IPs like 0.0.0.0 and 255.255.255.255).
• ⚡ Process Termination: Terminates running malware processes by matching the process name, executable path, and command line.
• 🔑 Registry Persistence Removal: Dynamically enumerates and removes malicious autostart entries across User (HKCU) and System (HKLM) Run and RunOnce registry keys.
• 🧹 File & Folder Remediation: Sweeps common malware locations to erase dropped executables (.exe), shortcuts (.lnk), scripts (.bat), or matching payload copies, and automatically removes empty parent folders.
• ⚡ Clean & Modular Architecture: Built with simple, high-performance, single-responsibility modules.

---

📋 System Requirements

• Python 3.8+
• psutil (pip install -r requirements.txt)
• Windows 10 / 11 VM
• Administrator Privileges (required for HKLM registry & system startup cleanup)

---

⚠️ Pre-requisites & Lab Setup

Caution

Windows Defender may automatically quarantine or delete malware samples during dynamic analysis. Disable real-time protection in your isolated VM before running tests.

1. Disable Windows Defender Real-Time Protection

Run PowerShell as Administrator and execute:

Set-MpPreference -DisableRealtimeMonitoring $true

(Note: Ensure Tamper Protection is turned off in Windows Security settings if execution is blocked).

2. Unblock Downloaded Analysis Tools & Malware Files Run PowerShell as Administrator and execute:

Get-ChildItem -Path "C:\Users\soha\Downloads" -Recurse | Unblock-File

🚀 Installation & Usage

1. Installation

# Clone repository
git clone https://learn.zone01oujda.ma/git/sohachimi/defuse

# Navigate into project directory
cd defuse

# Install dependencies
python -m pip install -r requirements.txt

2. Usage

python src/main.py <malware_filename_or_stem>

Examples:

python src/main.py maltrack
:: or
python src/main.py mal-track
:: or
python src/main.py mal-track.exe

Note

You do not need to specify a full file path — Defuse automatically discovers the sample in common system drop locations.

---

🖥️ Console Output Example

========================================
                DEFUSE
========================================

Target: mal-track.exe

[+] Malware found
[+] Attacker IP: 127.0.0.1
  [+] Terminated process: maltrack.exe (PID: 2844)
[+] Process terminated
  [+] Deleted registry value: maltrack
[+] Registry persistence removed
  [+] Deleted file: C:\Users\soha\Documents\maltrack\maltrack.exe
  [+] Removed empty directory: C:\Users\soha\Documents\maltrack
[+] Malware files deleted

========================================
                Summary
========================================
Process  : OK
Registry : OK
Files    : OK
IP       : 127.0.0.1

---

🧩 Architecture & Module Design

Defuse consists of seven clean, single-purpose Python modules:

defuse/
│
├── src/
│   ├── main.py        # CLI entry point & execution orchestrator
│   ├── finder.py      # Targeted payload discoverer across common drop locations
│   ├── strings.py     # Binary string extractor & IPv4 C2 parser
│   ├── process.py     # Safe process detector & killer (ignores python & current PID)
│   ├── registry.py    # Windows Registry Run/RunOnce persistence cleaner
│   ├── remover.py     # Payload copy eraser & empty directory cleaner
│   └── utils.py       # Path resolvers, string normalizer & safe file deleter
│
├── requirements.txt   # Project dependencies (psutil)
└── README.md          # Comprehensive documentation & mitigation report

Module Breakdown

Module	Function	Description
main.py	main()	CLI entry point orchestrating discovery, string extraction, process termination, registry cleaning, and file removal.
finder.py	find_malware()	Searches recursively within common malware locations (Desktop, Documents, Downloads, AppData, Temp, Startup).
strings.py	extract_ip()	Extracts ASCII & UTF-16LE binary strings to find the C2 IPv4 address, filtering out 0.0.0.0 and 255.255.255.255.
process.py	terminate_process()	Scans active processes by name, path, and command line; terminates malware while ignoring python and os.getpid().
registry.py	clean_registry()	Scans and deletes matching autostart values from HKCU and HKLM Run and RunOnce keys dynamically.
remover.py	remove_files()	Sweeps target malware locations for matching .exe, .lnk, .bat or stem copies, deletes files, and removes empty folders.
utils.py	normalize_name(), get_malware_locations(), safe_delete_file()	Provides string normalization, malware search paths, and read-only permission reset for file deletion.

---

🔬 Malware Behavioral Analysis (mal-track.exe)

During dynamic analysis inside an isolated Windows 10 VM, the following behavior was documented:

• Original Sample Name: mal-track.exe
• Dropped Payload Path: C:\Users\soha\Documents\maltrack\maltrack.exe
• Active Execution Name: maltrack.exe
• Command & Control (C2) IP: 127.0.0.1
• Autostart Persistence:
  • Registry entry created under:
    • HKCU\Software\Microsoft\Windows\CurrentVersion\Run

---

Walkthrough

1. Launch the malware inside an isolated Windows VM.
2. Observe its behavior using Process Explorer, Process Monitor, Registry Editor and Wireshark.
3. Run Defuse with the malware filename.
4. Defuse locates the malware automatically.
5. The C2 IP address is extracted from the binary.
6. Running malware processes are terminated.
7. Registry persistence entries are removed.
8. Malware files are deleted from common locations.
9. Verify that the malware process, registry entry and dropped files no longer exist.

---

📸 Proof of Mitigation

1. Payload Copy Dropped in User Documents

The malware copied itself to C:\Users\soha\Documents\maltrack\maltrack.exe to establish a persistent footprint.

---

2. Active Execution in Process Explorer

Process Explorer showing maltrack.exe running as an active background process.

---

3. System Operations Recorded in Process Monitor

Process Monitor showing the malware creating files and modifying the Windows Registry during execution.

---

4. Registry Autostart Entry

The malware creates a persistence entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

---

5. Command & Control Traffic in Wireshark

Wireshark capturing the malware communication with the C2 IP address 127.0.0.1.

---

🛡️ Defensive Remediation Best Practices

To safeguard enterprise endpoints against similar threats:

1. Principle of Least Privilege (PoLP): Restrict standard user accounts from possessing local administrator rights to prevent unauthorized modification of HKLM registry hives.
2. Endpoint Detection & Response (EDR): Configure EDR tools to alert on untrusted executable creation originating from user directories (Documents, AppData, Temp).
3. Application Control (AppLocker / WDAC): Enforce rules that block untrusted executable binaries running outside %ProgramFiles%.
4. Registry Integrity Monitoring: Monitor key autostart registry paths (Run, RunOnce) for unexpected modifications.

---

📜 Ethical Hacking & Security Report

1. Importance of Controlled Lab Environments

Malware analysis must always take place inside isolated Virtual Machines (e.g., VirtualBox with Host-Only networking). Isolation guarantees malicious code cannot exfiltrate sensitive data, spread across the network, or compromise host environments.

2. Legal & Ethical Frameworks

Security professionals must operate strictly within legal permissions and ethical boundaries. Reverse engineering and analyzing malware is lawful and necessary when performed inside authorized lab environments for defensive research.

3. Risks of Uncontained Malware Execution

Executing live malware on non-isolated systems can cause severe data loss, ransomware encryption, unauthorized remote access, lateral network movement, and accidental system destruction.

---

📧 Incident Report Summary

To: security@zone01.com
Subject: Malware Analysis Report: Mitigation of maltrack

Dear Security Team,

I am writing to report the successful analysis and mitigation of maltrack identified during an educational malware analysis exercise. Below are the details:

Summary:
The malware established persistence by creating a registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, communicated with the C2 IP address 127.0.0.1, and executed as the process maltrack.exe.

Proof of Mitigation:
The malware process was successfully terminated, the registry persistence entry was removed, and the malware executable and its dropped copy were deleted from the system using the Defuse malware removal tool.

Attacker Information:
The malware communicated with the following IP address: 127.0.0.1.

Please feel free to reach out for further clarification or additional details.

Best regards,

Sohachimi
sohachimi.dev@gmail.com