maco-extractor

import os from maco.model import ExtractorModel from maco.extractor import Extractor from maco.collector import run_extractor # Define a simple Maco Extractor class MySimpleExtractor(Extractor): # Yara rules can be defined here as a bytes object # rules = b'rule my_rule { strings: $a = "test_data" condition: $a }' def run(self, sample: bytes, **kwargs) -> ExtractorModel: # Example: if a specific string is found, set a property in the model if b"hello maco" in sample: model = ExtractorModel(family="GreetingMalware") model.add_tag("found_greeting") model.add_string(value="hello maco", context="sample_content") return model # All extractors must return an ExtractorModel, even if no config is found return ExtractorModel(family="Unknown") # Create a dummy file for the extractor to process sample_content = b"This is some test_data with hello maco inside." sample_path = "test_sample.bin" with open(sample_path, "wb") as f: f.write(sample_content) try: # Run the extractor against the sample file # 'extractors' expects a list of Extractor classes results = run_extractor(extractors=[MySimpleExtractor], sample_path=sample_path) # Print the results print(f"Extractor results for {sample_path}:") for result in results: print(f" Family: {result.family}") print(f" Tags: {result.tags}") print(f" Strings: {[s.value for s in result.strings]}") except Exception as e: print(f"An error occurred: {e}") finally: # Clean up the dummy file if os.path.exists(sample_path): os.remove(sample_path)