The Australian Signals Directorate (ASD) has launched Azul, a malware analysis platform built for reverse engineers and incident investigations. It is the first public release of the tool, which is now at version 9.0.0..
The ASD is Australia's intelligence agency, operating under the Department of Defence. The Australian Cyber Security Centre (ACSC) handles national cybersecurity guidance and incident response.
Please note that Azul is not a screening tool and does not determine whether a file is malicious. Samples should first be flagged using a tool such as the Canadian Cybersecurity Centre's AssemblyLine before being fed into Azul.
The platform is built using Python, Golang, and TypeScript. It runs on Kubernetes via Helm chart templates, uses Apache Kafka for event queuing, and stores samples in an S3-compatible repository.
Monitoring and alerting are supported via Prometheus, Loki, and Grafana. Azul also features a web interface, an HTTP REST API, and a headless client for integration with external systems.
It supports YARA rules, Snort signatures, and the Maco framework for malware configuration extraction. Access to malware samples is controlled via OpenID Connect.
Azul has three main elements.
The malware repository to store samples with source metadata, including hostnames, filenames, network details, and timestamps. It is designed to keep everything indefinitely, provided ample storage space is provided.
The analysis engine allows teams to turn reverse engineering into reusable plugins that run automatically. When a plugin is updated, it can be run again, and they can highlight new findings from previous incidents.
The clustering suite uses OpenSearch to find patterns in samples, helping analysts identify shared infrastructure, deployment patterns, and behavioral similarities. It also draws on data from industry reports to reinforce these findings.
The source code for Azul can be found on GitHub , licensed under the MIT license.
The repository includes a README file to get you started. Full documentation covering installation and developer guides is hosted on the official Azul documentation portal.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
