extracting-iocs-from-malware-samples

name	extracting-iocs-from-malware-samples
description	Extracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule creation. Activates for requests involving IOC extraction, threat indicator harvesting, malware indicator collection, or building detection content from samples.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware","IOC-extraction","threat-intelligence","indicators","detection"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Extracting IOCs from Malware Samples

When to Use

• A malware analysis (static or dynamic) is complete and actionable indicators need to be extracted for defense teams
• Building blocklists for firewalls, proxies, and DNS sinkholes from analyzed samples
• Creating YARA rules, Snort/Suricata signatures, or SIEM detection content from malware artifacts
• Contributing to threat intelligence sharing platforms (MISP, OTX, ThreatConnect)
• Tracking malware campaigns by correlating IOCs across multiple samples

Do not use for IOCs from unverified sources without validation; false positives in blocklists can disrupt legitimate business operations.

Prerequisites

• Python 3.8+ with iocextract, pefile, yara-python libraries installed
• Completed malware analysis report (static analysis, dynamic analysis, or reverse engineering)
• Access to PCAP files, memory dumps, or sandbox reports from the analysis
• MISP instance or STIX/TAXII server for structured IOC sharing
• VirusTotal API key for IOC enrichment and validation
• CyberChef for decoding obfuscated indicators

Workflow

Step 1: Extract File-Based IOCs

Compute hashes and identify file metadata indicators:

# Generate all standard hashes
md5sum malware_sample.exe
sha1sum malware_sample.exe
sha256sum malware_sample.exe

# Generate ssdeep fuzzy hash for similarity matching
ssdeep malware_sample.exe

# Generate imphash (import hash) for PE files
python3 -c "
import pefile
pe = pefile.PE('malware_sample.exe')
print(f'Imphash: {pe.get_imphash()}')
"

# Generate TLSH (Trend Micro Locality Sensitive Hash)
python3 -c "
import tlsh
with open('malware_sample.exe', 'rb') as f:
    h = tlsh.hash(f.read())
print(f'TLSH: {h}')
"

# Compile file metadata IOCs
python3 << 'PYEOF'
import pefile
import os
import hashlib
import datetime

pe = pefile.PE("malware_sample.exe")

print("FILE IOCs:")
with open("malware_sample.exe", "rb") as f:
    data = f.read()
    (f)
    (f)
    (f)
    (f)

ts = pe.FILE_HEADER.TimeDateStamp
(f)
(f)
PYEOF