---
id: maco-extractor
version: "1.3.2"
license: MIT License Copyright (c) 2022 Crown Copyright, Government of Canada (Canadian Centre for Cyber Security / Communications Security Establishment) and Government of Australia (Australian Cyber… (full text in the JSON record)
license_treatment: permissive
maintenance: active
---

# maco-extractor — This package contains the essentials for creating Maco extractors and using them at runtime.

License: permissive · Maintenance: active · Downloads: 90.6K/mo

## What it is and what it does

Maco is a framework for building standardized malware configuration extractors. It solves two core problems: defining a common ontology for extractor output (via a Pydantic-based data model) and providing a standard way to identify and execute the right parsers for a given sample. The framework includes a base extractor class, a collector for loading and running extractors, a CLI tool for local testing, and utilities for unit testing extractors.

The package is designed for security researchers and malware analysts who need to extract configuration data from malware samples in a consistent, machine-readable format. It depends on pydantic for data validation and yara-x for pattern matching. The model supports a wide range of malware metadata—families, versions, C2 communications (HTTP, TCP, SSH, DNS, etc.), encryption details, campaign IDs, and custom fields—making it suitable for integration into larger malware analysis platforms and knowledge bases.

Use it for:

- Build custom malware config extractors that output standardized, validated data compatible with downstream analysis platforms
- Integrate multiple extractor frameworks by harmonizing their output into a common MACO model format
- Create unit tests for malware extractors using the provided base test utilities
- Run extractors locally via the CLI tool to validate extraction logic during development
- Export extracted malware configurations in a machine-friendly format for database ingestion or threat intelligence sharing

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Maco is a framework for standardizing malware configuration extractor output and execution, providing a common data model and utilities for building, running, and testing extractors.

Yes. The package is actively maintained, has low install friction, carries no known vulnerabilities, and uses a permissive MIT license. It is production-stable and actively used by established malware analysis platforms. Install it if you are building or integrating malware configuration extractors and need a standardized output model and execution framework.

## Install

pip install maco-extractor
uv add maco-extractor
poetry add maco-extractor

## Installing maco-extractor

Before you install: Low install friction with a pure-Python wheel and only two runtime dependencies (pydantic and yara-x). The package is actively maintained with a recent release and supports Python 3.8 through 3.12.

License in practice: MIT License permits unrestricted use, modification, and distribution. The copyright is held jointly by Canadian and Australian government cybersecurity agencies, but the permissive terms mean no restrictions on commercial or proprietary use.

Quickstart:

pip install maco-extractor

from maco import model

output = model.ExtractorModel(family="malware_name")
output.http.append(model.ExtractorModel.Http(
    protocol="https",
    uri="https://c2.example.com",
    usage="c2"
))
print(output.model_dump(exclude_defaults=True))

Verify before relying:

- Whether yara-x is available as a pre-built wheel on all supported platforms or requires compilation
- Performance characteristics when handling large-scale extractor runs or complex malware samples
- Compatibility details between maco-extractor and the maco-model package mentioned in the description

## Package facts

- License: MIT License Copyright (c) 2022 Crown Copyright, Government of Canada (Canadian Centre for Cyber Security / Communications Security Establishment) and Government of Australia (Australian Cyber… (full text in the JSON record) (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 90.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

malware config extraction framework, standardized extractor output model, malware analysis data model, extractor base class and utilities, config parser framework, malware intelligence extraction, extractor orchestration, malware-analysis, security-research, config-extraction

[View on SkillFed](https://skillfed.io/packages/maco-extractor) · [View on PyPI](https://pypi.org/project/maco-extractor/)