maco-extractor

What it is and what it does

Maco is a framework for building standardized malware configuration extractors. It solves two core problems: defining a common ontology for extractor output (via a Pydantic-based data model) and providing a standard way to identify and execute the right parsers for a given sample. The framework includes a base extractor class, a collector for loading and running extractors, a CLI tool for local testing, and utilities for unit testing extractors.

The package is designed for security researchers and malware analysts who need to extract configuration data from malware samples in a consistent, machine-readable format. It depends on pydantic for data validation and yara-x for pattern matching. The model supports a wide range of malware metadata—families, versions, C2 communications (HTTP, TCP, SSH, DNS, etc.), encryption details, campaign IDs, and custom fields—making it suitable for integration into larger malware analysis platforms and knowledge bases.

Use it for:

• Build custom malware config extractors that output standardized, validated data compatible with downstream analysis platforms
• Integrate multiple extractor frameworks by harmonizing their output into a common MACO model format
• Create unit tests for malware extractors using the provided base test utilities
• Run extractors locally via the CLI tool to validate extraction logic during development
• Export extracted malware configurations in a machine-friendly format for database ingestion or threat intelligence sharing

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Maco is a framework for standardizing malware configuration extractor output and execution, providing a common data model and utilities for building, running, and testing extractors.

Yes. The package is actively maintained, has low install friction, carries no known vulnerabilities, and uses a permissive MIT license. It is production-stable and actively used by established malware analysis platforms. Install it if you are building or integrating malware configuration extractors and need a standardized output model and execution framework.

Install

maco-extractor on PyPI

pip install maco-extractor

uv add maco-extractor

poetry add maco-extractor

Installing maco-extractor

Before you install

Low install friction with a pure-Python wheel and only two runtime dependencies (pydantic and yara-x). The package is actively maintained with a recent release and supports Python 3.8 through 3.12.

License in practice

MIT License permits unrestricted use, modification, and distribution. The copyright is held jointly by Canadian and Australian government cybersecurity agencies, but the permissive terms mean no restrictions on commercial or proprietary use.

Quickstart

pip install maco-extractor

from maco import model

output = model.ExtractorModel(family="malware_name")
output.http.append(model.ExtractorModel.Http(
    protocol="https",
    uri="https://c2.example.com",
    usage="c2"
))
print(output.model_dump(exclude_defaults=True))

Verify before relying

• Whether yara-x is available as a pre-built wheel on all supported platforms or requires compilation
• Performance characteristics when handling large-scale extractor runs or complex malware samples
• Compatibility details between maco-extractor and the maco-model package mentioned in the description

Package facts

Evidence: maco_extractor-1.3.2-py3-none-any.whl

Tags

More Python Modules packages