Marketplace

malchela-marketplace

MalChela — A YARA & Malware Analysis Toolkit with Claude MCP integration for DFIR analysts.

npx claudepluginhub dwmetz/malchela

README

View full README on GitHub

1 Plugin

malchela

108

MalChela malware analysis toolkit — exposes file analysis, string extraction, hash lookup, NSRL queries, and directory scanning to Claude via MCP. Built for DFIR analysts and malware researchers.

today

v4.0

Related Marketplaces

antigravity-awesome-skills

36.4K

0plugins

Claude Code marketplace entries for the plugin-safe Antigravity Awesome Skills library and its compatible editorial bundles.

claude-code-workflows

34.7K

0plugins

Production-ready workflow orchestration with 79 focused plugins, 184 specialized agents, and 150 skills - optimized for granular installation and minimal token usage

claude-plugins-official

18.5K

0plugins

Directory of popular Claude Code extensions including development tools, productivity plugins, and MCP integrations

Stats

Plugins1

Stars108

UpdatedMay 6, 2026

Links

View on GitHub View Marketplace JSON

Help us improve

Share bugs, ideas, or general feedback.

Program	Function
Combine YARA	Combines all `.yara`/`.yar` files in a directory into a single rule file
Extract Samples	Recursively extracts password-protected malware archives (ZIP/RAR) using common passwords
File Analyzer	Analyzes a file for hashes, entropy, PE structure, fuzzy hashes, YARA matches, NSRL lookup, and VirusTotal status
File Miner	Scans a folder for file type mismatches and metadata
Hash It	Generates MD5, SHA1, and SHA256 hashes for a single file
Hash Check	Checks if a given hash exists in a provided hash set file
Malware Hash Lookup	Queries a hash against VirusTotal and MalwareBazaar for threat intelligence
mStrings	Extracts strings from a file, applies regex and Sigma rules, maps to MITRE ATT&CK, identifies IOCs, and includes built-in MITRE Technique lookup
mzhash	Recursively hashes files with MZ headers using MD5 — ideal for gold build or known-bad corpus generation
mzcount	Recursively counts files by format (MZ, ZIP, PDF, etc.) using header/YARA detection
nsrlquery	Queries an MD5 hash against the NSRL database to determine if it's known-good
strings_to_yara	Prompts for metadata and a string list to generate a YARA rule
xmzhash	Recursively hashes files that are not MZ, ZIP, or PDF — ideal for non-Windows malware corpus

Program

Function

Combine YARA

Combines all .yara/.yar files in a directory into a single rule file

Extract Samples

Recursively extracts password-protected malware archives (ZIP/RAR) using common passwords

File Analyzer

Analyzes a file for hashes, entropy, PE structure, fuzzy hashes, YARA matches, NSRL lookup, and VirusTotal status

File Miner

Scans a folder for file type mismatches and metadata

Hash It

Generates MD5, SHA1, and SHA256 hashes for a single file

Hash Check

Checks if a given hash exists in a provided hash set file

Malware Hash Lookup

Queries a hash against VirusTotal and MalwareBazaar for threat intelligence

mStrings

Extracts strings from a file, applies regex and Sigma rules, maps to MITRE ATT&CK, identifies IOCs, and includes built-in MITRE Technique lookup

mzhash

Recursively hashes files with MZ headers using MD5 — ideal for gold build or known-bad corpus generation

mzcount

Recursively counts files by format (MZ, ZIP, PDF, etc.) using header/YARA detection

nsrlquery

Queries an MD5 hash against the NSRL database to determine if it's known-good

strings_to_yara

Prompts for metadata and a string list to generate a YARA rule

xmzhash

Recursively hashes files that are not MZ, ZIP, or PDF — ideal for non-Windows malware corpus

Program	Function
Combine YARA	Combines all `.yara`/`.yar` files in a directory into a single rule file
Extract Samples	Recursively extracts password-protected malware archives (ZIP/RAR) using common passwords
File Analyzer	Analyzes a file for hashes, entropy, PE structure, fuzzy hashes, YARA matches, NSRL lookup, and VirusTotal status
File Miner	Scans a folder for file type mismatches and metadata
Hash It	Generates MD5, SHA1, and SHA256 hashes for a single file
Hash Check	Checks if a given hash exists in a provided hash set file
Malware Hash Lookup	Queries a hash against VirusTotal and MalwareBazaar for threat intelligence
mStrings	Extracts strings from a file, applies regex and Sigma rules, maps to MITRE ATT&CK, identifies IOCs, and includes built-in MITRE Technique lookup
mzhash	Recursively hashes files with MZ headers using MD5 — ideal for gold build or known-bad corpus generation
mzcount	Recursively counts files by format (MZ, ZIP, PDF, etc.) using header/YARA detection
nsrlquery	Queries an MD5 hash against the NSRL database to determine if it's known-good
strings_to_yara	Prompts for metadata and a string list to generate a YARA rule
xmzhash	Recursively hashes files that are not MZ, ZIP, or PDF — ideal for non-Windows malware corpus

Program

Function

Combine YARA

Combines all .yara/.yar files in a directory into a single rule file

Extract Samples

Recursively extracts password-protected malware archives (ZIP/RAR) using common passwords

File Analyzer

Analyzes a file for hashes, entropy, PE structure, fuzzy hashes, YARA matches, NSRL lookup, and VirusTotal status

File Miner

Scans a folder for file type mismatches and metadata

Hash It

Generates MD5, SHA1, and SHA256 hashes for a single file

Hash Check

Checks if a given hash exists in a provided hash set file

Malware Hash Lookup

Queries a hash against VirusTotal and MalwareBazaar for threat intelligence

mStrings

Extracts strings from a file, applies regex and Sigma rules, maps to MITRE ATT&CK, identifies IOCs, and includes built-in MITRE Technique lookup

mzhash

Recursively hashes files with MZ headers using MD5 — ideal for gold build or known-bad corpus generation

mzcount

Recursively counts files by format (MZ, ZIP, PDF, etc.) using header/YARA detection

nsrlquery

Queries an MD5 hash against the NSRL database to determine if it's known-good

strings_to_yara

Prompts for metadata and a string list to generate a YARA rule

xmzhash

Recursively hashes files that are not MZ, ZIP, or PDF — ideal for non-Windows malware corpus

malchela-marketplace

README

1 Plugin

malchela