maco

library1.2.26pypypiunverified

Maco is a framework for creating and using malware configuration extractors. It provides a modular approach to extract configuration data from malware samples. Current version is 1.2.26, with regular updates.

devops data

pip install maco

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · MACO

maco

devopspythonv1.2.26

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Extractor

✓ from maco import Extractor

✗ from maco import Extractor

Define a custom extractor by subclassing Extractor and implementing the run method.

from maco import Extractor class MyExtractor(Extractor): family = "my_family" author = "me" minimum_maco_version = "1.0.0" def run(self, path): with open(path, 'rb') as f: data = f.read() config = {} if b'config' in data: config['string'] = 'example' return config

maco --version

Debug

Known issues

breakingMaco v1.0 introduced a new base class signature. Earlier versions used a different interface. Extensions written for v0.x must be updated.

fix

Update extractor subclasses to use the new run() method signature (path argument instead of file-like object).

affects: <1.0

gotchaThe run() method must return a dict-like object that serializes to JSON. Non-serializable types will cause errors when collecting results.

fix

Ensure returned config contains only basic types (str, int, list, dict).

affects: >=1.0

deprecatedThe `maco.model` module is deprecated. New code should import from `maco` directly.

fix

Use `from maco import Extractor` instead of `from maco.model import Extractor`.

affects: >=1.2

Upgrade

Version history

1.2.26latest on PyPI · released Apr 17, 2026

Audit

Dependencies

yara-pythonoptionalRequired for YARA rule support in extractors

pyelftoolsoptionalUsed for ELF parsing

pefileoptionalUsed for PE parsing

Agent activity

3 hits · last 30 days

node