kush

Offline malware sample analysis from the terminal. Hash samples, extract metadata, analyze static posture and strings, surface network indicators and classify IOCs — without ever executing the sample on the developer host.

Guarantees

  • Static by design — samples are never executed on the developer host; dynamic execution is refused honestly
  • Nine-stage pipeline: intake, hashing, metadata, static, strings, behavior, network, IOC and risk
  • Deterministic rule engine (KSH-001+) with verified high-confidence IOC catalog
  • Risk scores are transparent: severity_weight × confidence × exposure, capped at 100

Install

git clone --depth 1 https://github.com/QYVORA/qyvora-kush && cd qyvora-kush && go build ./cmd/kush

Usage

  • kush assess --sim
  • kush sample --output sample.json
  • kush assess --sample sample.json
  • kush findings
  • kush evidence
  • kush report -f json --out report.json