[{"_1":2,"_166":-5,"_167":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_144":145},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_92":-5,"_93":94,"_133":-5,"_134":11,"_135":21,"_136":11,"_137":-5,"_138":11,"_139":-5,"_140":141,"_142":95,"_143":-7},"canonicalUrl","https://hub.docker.com/r/daschr/malunpacker/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","daschr","reponame","malunpacker","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_47":48,"_50":51,"_52":53,"_54":11,"_55":56,"_57":58,"_59":60,"_43":35,"_32":33,"_62":63,"_64":49,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":66,"_73":74,"_75":11,"_76":33,"_77":78,"_83":11,"_84":85,"_89":33,"_90":91},"categories",[42],{"_43":44,"_45":46},"name","Security","slug","security","content_types",[49],"image","date_registered","2024-05-06T12:27:38.074416Z","description","ICAP malware scanner, unpacks password-protected archives using a LLM.","is_private","last_updated","2025-12-03T14:57:01.989777Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[61],"application/vnd.docker.container.image.v1+json","pull_count",638,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","

malunpacker

\n ICAP service which unpacks password-protected attachments (.iso, .rar, .7z, .zip etc.) of various file types and scans them using YARA. Can be seamlessly integrated into rspamd.

\n Born out of the frustration that Rspamd/ClamAV cannot unpack password-protected mail attachments containing malware.\n

\n\n[![GitHub](https://img.shields.io/badge/GitHub-%23121011.svg?logo=github&logoColor=white)](https://github.com/daschr/malunpacker)\n\n## Capabilities\n- tries to unpack password protected attachments using the mail body as a knowledge base for passwords\n- can also use a LLM to extract the password from the mail body\n- unpacks\n |mime type|password protection|\n |---|---|\n |application/vnd.rar|yes|\n |application/x-7z-compressed|yes|\n |application/x-bzip|yes|\n |application/x-bzip2|yes|\n |application/x-tar|yes|\n |application/x-iso9660-image|yes|\n |application/x-rar|yes|\n |application/x-rar-compressed|yes|\n |application/zip|yes|\n- scans each dropped sample and attachment using the provided YARA rules; independent of the file type\n## Installation (Docker)\n1. use the provided [docker-compose.yml](https://github.com/daschr/malunpacker/blob/main/docker-compose.yml) and spawn the container\n2. got into the `etc` docker-volume of the container, create a `rules` directory and put your `.yar` rule files into it
\n (Note: a good start for rules may be https://yarahq.github.io/)\n3. restart the container and check that it's running\n4. Rspamd integration\n * go to your Rspamd configuration files and add the following to your `external_services.conf`\n ```\n malunpacker {\n servers = \"172.22.1.1:10055\";\n # needs to be set explicitly for Rspamd < 1.9.5\n scan_mime_parts = false;\n type = \"icap\";\n scheme = \"respmod\";\n x_client_header = true;\n # mime-part regex matching in content-type or filename\n # block all macros\n max_size = 3145728;\n timeout = 60.0;\n retransmits = 1;\n x_client_header = true; # Add X-Client-IP: $IP header\n x_rcpt_header = true; # Add X-Rcpt-To: $SMTP_RCPT header\n x_from_header = true; # Add X-Mail-From: $SMTP_FROM header\n }\n ```\n * adapt your `VIRUS_FOUND` symbol in your `composites.conf` and add the `MALUNPACKER` symbol to it's expression f.e.:\n ```\n VIRUS_FOUND {\n expression = \"( CLAM_VIRUS | MALUNPACKER ) & !WHITELIST\";\n score = 2000.0;\n }\n ```\n5. That's it! You can now test malunpacker by sending some archive containeing malware or some ISO.\n## LLM for credential extraction\nYou may also enable the use of a LLM for credential extraction by specifing the environment variable `USE_ML_FOR_CREDS_EXTRACTION=true` in your docker-compose file.\n\nThe service uses [rust-bert](https://github.com/guillaume-be/rust-bert) for the ML part.","has_starred","hub_user","immutable_tags_settings",{"_79":11,"_80":81},"enabled","rules",[82],".*","is_automated","permissions",{"_86":21,"_87":11,"_88":11},"read","write","admin","user","storage_size",8718025415,"orgData","recentTags",[95],{"_96":49,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_55":122,"_123":98,"_124":33,"_125":61,"_43":126,"_127":128,"_129":113,"_130":122,"_131":70,"_132":21},"content_type","creator",25824023,"digest","sha256:a504d2900e83138a7c3dea256d1d1b5bebb56d3a6de63ee6a26b37bca3ef66d6","full_size",304262165,"id",659314272,"images",[107],{"_108":109,"_99":100,"_110":111,"_112":113,"_114":115,"_116":117,"_118":111,"_119":-5,"_120":102,"_67":70,"_121":-5},"architecture","amd64","features","","last_pulled","2026-10-05T19:40:17.815250607Z","last_pushed","2025-12-03T14:57:00.572512259Z","os","linux","os_features","os_version","size","variant","2025-12-03T14:57:00.931991Z","last_updater","last_updater_username","media_type","latest","repository",24027051,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":146,"_154":155,"_140":164,"_165":11},{"_40":147,"_47":149,"_50":51,"_52":53,"_54":11,"_55":56,"_57":58,"_59":150,"_43":35,"_32":33,"_62":63,"_64":49,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":66,"_73":74,"_75":11,"_76":33,"_77":151,"_83":11,"_84":153,"_89":33,"_90":91},[148],{"_43":44,"_45":46},[49],[61],{"_79":11,"_80":152},[82],{"_86":21,"_87":11,"_88":11},"tags",{"_156":68,"_157":-5,"_158":-5,"_159":160},"count","next","previous","results",[161],{"_96":49,"_97":98,"_99":100,"_101":102,"_103":104,"_105":162,"_55":122,"_123":98,"_124":33,"_125":61,"_43":126,"_127":128,"_129":113,"_130":122,"_131":70,"_132":21},[163],{"_108":109,"_99":100,"_110":111,"_112":113,"_114":115,"_116":117,"_118":111,"_119":-5,"_120":102,"_67":70,"_121":-5},[],"canDeleteTags","actionData","errors"]

daschr/malunpacker

Tags for daschr/malunpacker