iiinova — where your digital self keeps evolving

Malcat dev @malcat4ever.bsky.social · 22/09/2026

For full and pro users: we've released malcat 1.0.0-alpha3 for you to preview. It ships with: ● many GUI improvements (like side-by-side tabs) ● an even better MCP server with support for sandbox python transforms ● the first usable .NET and PYC decompilers!

020

Malcat dev @malcat4ever.bsky.social · 09/07/2026

In the upcoming 0.9.15 release, Malcat will embed its own 100% native #capa engine. So you get: - x10 .. up to x100 scan speedup - command line tool (using headless malcat lib) - embedded capa rule editor - additional architectures: arm, mips and even ... python:

000

Malcat dev @malcat4ever.bsky.social · 04/05/2026

#Malcat 0.9.14 is out! This is a maintenance build, with some bonuses: ● AccessDB parsing ● RAR unpacking ● UPX (static) unpacking ● Improved __noreturn detection ● ... and as usual, up-to-date signature, constants and Kesakode DBs. Happy reversing!

000

Malcat dev @malcat4ever.bsky.social · 20/03/2026

In Malcat, hitting <Ctrl+M> will start the in-GUI MCP server (works in free version too). You can then interact with the current analysis using your LLM of choice. Here I renamed functions and variables of the C2 dispatcher function for an unknown malware:

010

Malcat dev @malcat4ever.bsky.social · 24/02/2026

Quick peek at the upcoming 0.9.3 release. It will also feature a 100% headless MCP server for full and pro users.

000

Malcat dev @malcat4ever.bsky.social · 05/02/2026

Sometimes, the absence of signature match is also interesting. Here the hashtag#Chrysalis sideloaded dll, where we can quickly spot the few interesting functions. Make sure to check "Show UNK" !

000

Malcat dev @malcat4ever.bsky.social · 21/01/2026

A quick update on Malcat's MacOS development (apple silicon): A couple of visual glitches, but the analysis & UI are now functional \o/

010

Malcat dev @malcat4ever.bsky.social · 05/12/2025

#Malcat tip: #Kesakode can be useful even when facing unknown/packed samples. Check "Show UNK" and focus on unique code and strings. Here a simple downloader:

000

Malcat dev @malcat4ever.bsky.social · 25/09/2025

#Malcat tip #10: analysing backdoored clean software can be hard. A quick win is to pivot around known constants, thanks to Malcat's 400k+ constants DB (here a #Tropidoor dlder):

010

Malcat dev @malcat4ever.bsky.social · 12/09/2025

Updated #kesakode to 1.0.38: Malware signatures: * New malware entries: 20 new families * 564116 new unique functions * 197608 new unique strings * 27 new unique constant fingerprints

010

Malcat dev @malcat4ever.bsky.social · 01/06/2025

Does someone know this #malware, since this is definitely NOT latrodectus. Looks like some Discord-backed infostealer: bazaar.abuse.ch/sample/85f8c...

000

Malcat dev @malcat4ever.bsky.social · 27/05/2025

You can now check your strings in #malcat against an online library of #Malpedia FLOSSed strings. Just copy this plugin: github.com/malpedia/mal...

000

Malcat dev @malcat4ever.bsky.social · 22/04/2025

then how do you quickly confirm the AI assertion without input/output testing? It may be a sha256 variant. You know well malware authors like to modify standard algorithms. If it's just saying "it looks like sha256", it's also very quick to say without AI:

100

Malcat dev @malcat4ever.bsky.social · 17/01/2025

Malcat tip #9: So you have found this nice #malware hash in a report, but no sample? "File>Download from hash" will retrieve the hash for you from: ● Triage ● MalwareBazaar ● VirusShare ● MWDB ● FileScanIO NB: some of these sources require (free) API keys.

000

Malcat dev @malcat4ever.bsky.social · 14/01/2025

In the next version of #malcat, we will include an _offline_ smaller #kesakode database which will only contain conflict-free malware signatures. This will be fast and run with every analysis. You can always get the full deal (clean + lib) afterwards with an online query.

000

Malcat dev @malcat4ever.bsky.social · 27/12/2024

You'll soon be able to export #Malcat views to files: ● Summary report as HTML+ SVG ● Proximity & call graph views as SVG or PNG ● Struct/hex/disasm views as HTML ● Strings, symbols, intel, kesakode and other views as CSV

010