capa is the FLARE team's tool to identify capabilities in executable files. Run it against a PE, ELF or .NET module, or raw shellcode, and it tells you what the program can do: for example, that it acts as a backdoor, installs a service or communicates over HTTP. Results are mapped to MITRE ATT&CK and the Malware Behavior Catalog. The standard rule set and FLIRT library signatures are included.
Examples
capa suspicious.exe
capa -vv suspicious.exe
capa --json suspicious.exe > report.json
capa -f sc64 shellcode.bin
capa -r ~/capa-rules suspicious.exe
capa.show-features suspicious.exe
Backends
The vivisect and .NET backends, BinExport2 files, capa freeze files and CAPE, DRAKVUF and VMRay sandbox reports are supported. The IDA, Binary Ninja and Ghidra backends need those programs installed on the host and are unavailable.
File access
capa can analyze files in your home directory. To analyze files on USB drives and other removable media (/media, /mnt), run:
sudo snap connect capa:removable-media
You are about to open
Do you wish to proceed?
Thank you for your report. Information you provided will help us investigate further.
There was an error while sending your report. Please try again later.
Snaps are applications packaged with all their dependencies to run on all popular Linux distributions from a single build. They update automatically and roll back gracefully.
Snaps are discoverable and installable from the Snap Store, an app store with an audience of millions.
Snap can be installed from the command line on openSUSE Leap 15.x and Tumbleweed.
You need first add the snappy repository from the terminal. Choose the appropriate command depending on your installed openSUSE flavor.
Tumbleweed:
sudo zypper addrepo --refresh https://download.opensuse.org/repositories/system:/snappy/openSUSE_Tumbleweed snappy
Leap 15.x:
sudo zypper addrepo --refresh https://download.opensuse.org/repositories/system:/snappy/openSUSE_Leap_15.6 snappy
If needed, Swap out openSUSE_Leap_15. for, openSUSE_Leap_16.0 if you’re using a different version of openSUSE.
With the repository added, import its GPG key:
sudo zypper --gpg-auto-import-keys refresh
Finally, upgrade the package cache to include the new snappy repository:
sudo zypper dup --from snappy
Snap can now be installed with the following:
sudo zypper install snapd
You then need to either reboot, logout/login or source /etc/profile to have /snap/bin added to PATH.
Additionally, enable and start both the snapd and the snapd.apparmor services with the following commands:
sudo systemctl enable --now snapd
sudo systemctl enable --now snapd.apparmor
To install capa, simply use the following command:
sudo snap install capa
Browse and find snaps from the convenience of your desktop using the snap store snap.
Interested to find out more about snaps? Want to publish your own application? Visit snapcraft.io now.