CAPA

binary

Identifies capabilities (persistence, C2, etc.) in a binary automatically.

Location

/usr/local/bin/capa

How to run

capa sample.exe

Reference

https://github.com/mandiant/capa

---

Part of the Malware & Forensics toolset in DetectOps.