Malcat

Reverse engineers have a lot of options nowadays when it comes to analysing known software: IDA, Binary Ninja, Ghidra and many more. So one may ask: was another binary analysis software really needed?

IDA-like tools are basically made to answer one big question: how does a given binary software work? And they are really good at it, provided you plan to spend several hours digging in the same binary.

Malware analysts, incident responders and SOC analysts on the other hand have to analyse and triage large amounts of unknown binaries in a short time span. When opening a file, they do not care as much for the how as for the what. They want to know what is the file they are looking at and what it contains. And because malware are tricky, they have to answer this question for a lot of different file types (installers, archives, office documents, programs, ...) and architectures (NSIS, AutoIT, .NET, python, x86/64, ...). And this is a different problematic, different enough to justify the need for another class of tool.

Until now, malware analysts had to rely on either outdated tools (like the excellent Hiew) or on a lot of different utilities, each addressing a small subset of the problem. Malcat tries to combine all the features of these utilities in a single, powerful user interface. So yes, Malcat also embeds a disassembler and a decompiler like IDA, but the similarity ends there: they are two different types of tool which play in different categories.

Yes, Malcat can work offline, although you won't be able to use the intelligence scripts of course. There is a procedure to activate the software offline, see our our manual for more details.

If you purchase a license, you may run the software for an unlimited period of time. You only get updates for one year though. After this period of one year, you may still run the software, but won't be able to get new updates until you renew your license.

You don't have to renew the license every year though, you may chose to renew your license at the time of your choice (even long after the 1 year threshold) and you will always benefit of the low license renewal price (50%). We don't want to milk users every year. It's up to us to convince you that Malcat's improvements are worth it.

The non-pro version of Malcat is targeted towards hobbyists: they will get all features of Malcat for a reasonable price. The main limitation is that you are not able to use Malcat in a commercial/professional context and you get a little less monthly Kesakode quota. Also in order to keep the price low, limited support is available in this version.

Commercial use means use in your daily (paid) job or in any activity that directly or indirectly generates revenues. Here are two examples that may be helpful:

• Non-commercial usage: You are a network administrator at a commercial organization with discretionary budget and have been practicing CTF on your own time using work resources (approved by work). Your usage qualifies for non-commercial use as you are using Malcat purely for educational, non-commercial purposes.
• Commercial usage: You are a network administrator at a non-profit or government organization who regularly engages in malware analysis as a part of your job. You plan to use Malcat to analyze malware during paid work-hours. Your use is commercial.

We also apply a "de minimis" standard. If your use (running ads on Youtube videos, for example) makes you less money than 5 times the cost of a pro license, we're happy to have you continue to use a personal license. Once you start making above this amount, we ask that you then upgrade. If you have a doubt, contact us for more information.

On this website, you will only be able to purchase named licensed. If you want to include Malcat into your service / pipeline, contact us and we will work an OEM license out.

If you own a named license, which is the case if you bought it from this website, the license is bound to you and only you. As stipulated in the EULA, it means that you cannot rent or make the software available to other users. This includes the integration of the python module into any user-facing program and/or service. Here are some examples of what you may or may not do with your personal license:

• OK: You are a SOC analyst. You've made a script to assist you in your job which automatically updates your incident tickets with information coming from Malcat. This fits within the bounds of a named license.
• Not OK: You are a SOC analyst. You've made a script that automatically updates all incident tickets of your SOC with information coming from Malcat and integrated it in the SOC stack of your company. This is assimilated to sharing the software with other users.
• OK: You are a security/academical researcher and used Malcat's python module and its CFG reconstruction to analyse large batch of files and do machine-learning detection. You have published the result of your research online. This all fits within the bounds of a named license.
• Not OK: You are a security/academical researcher and used Malcat's python module and its CFG reconstruction to analyse large batch of files and do machine-learning detection. You have additionally made a online service where users can scan their files online using your technology. This also assimilated to sharing the software with other users.

No trick there, this is merely common sense. If you want to integrate Malcat in a multi-user software and/or online service, you can contact us and we will work a OEM license out. Don't worry, chances are it will be much cheaper than the concurrence.^

Purchase orders and invoices are supported for purchases of 5 or more copies of the Pro license. Contact us for more information.

There is no student discount at this time, simply because verifying student status would cost too much time. Instead, we offer free 1-year licenses for IT-Security classes. Just ask your professor to contact us with a copy of your class curriculum and we will see what we can do.