karton is a distributed malware processing framework from CERT-Polska that chains analysis microservices into a robust pipeline over Python, Redis and S3-compatible storage for authorized CERT and CSIRT operations.
| Tool | CERT-Polska/karton — distributed malware processing framework built on Python, Redis and S3 |
| Category | Malware analysis automation / distributed task pipeline |
| Primary Use | Chaining analysts' Python PoC scripts into monitored, centralized analysis pipelines that classify, unpack, and extract configs from malware samples inside an authorized lab |
| Safe Use | Designed for CERT/CSIRT teams, malware researchers and defenders operating isolated analysis backends; all processing happens on infrastructure the operator owns, on samples lawfully obtained |
| Telemetry Note | As a defensive backend it leaves no footprint on victim infrastructure; its own activity is visible in Redis task queues, karton logs streams and the karton-dashboard monitoring UI |
karton is the flagship open-source project of CERT-Polska, Poland's national CERT, and it addresses a problem every mature analysis team eventually hits: the pile of proof-of-concept scripts written by analysts in the heat of an incident that work, produce valuable intel, but are fragile, unmonitored, and impossible to compose into a coherent workflow. The README is refreshingly candid about this, describing duct-taped scripts and the need to insert them into a pipeline with centralised logging, execution monitoring and reduced development inertia. With 484 stars, a BSD-3-Clause license and a Python codebase, it is a production-grade framework rather than a weekend experiment — it is the actual backbone the CERT uses for its own incident-driven automation.
Architecturally, karton is a distributed message-passing system with three moving parts: Python consumers, a Redis instance acting as the task broker, and S3-compatible object storage holding the payloads and artifacts. The repository itself contains two key pieces: karton.system, the main dispatcher service that routes tasks between consumers, and karton.core, the library that every consumer service imports. This separation is deliberate — the framework stays small and stable while the analysis logic lives in independent, composable services that declare what they consume and emit.
The programming model is what makes karton elegant. You subclass Karton, set an identity string, and declare filters — dictionaries describing the kind of task you want to receive, such as {"type": "sample", "kind": "runnable", "platform": "win32"}. The process() method receives a Task, pulls binary content via task.get_resource("sample"), does its work, and then calls self.send_task() with a new Task whose headers describe the output. That header-based routing means services never know about each other; the dispatcher matches emitted headers against declared filters, and a pipeline assembles itself organically as you add components.
Installation is minimal from the operator side: pip3 install karton-core gets you the library and CLI, and the docs walk through standing up the Redis and S3 backends. The package also ships a karton command-line utility for lightweight management — karton configure scaffolds a configuration file, karton list -s shows current service bindings with their versions, karton logs streams system-wide logs, and karton delete retires an unused bind. The README is careful to note this is not a full management tool; for that there is karton-dashboard, a small Flask UI for task and queue monitoring.
The ecosystem around the framework is where karton becomes a genuine analysis platform rather than a library. karton-classifier acts as the router, recognising file formats and emitting typed tasks so downstream services can listen only for, say, zip archives. karton-archive-extractor decomposes archives into individually processed files, while karton-asciimagic decodes files obfuscated with common encodings like hex and base64 — a nod to how routine such trivial obfuscation is in real sample feeds. karton-yaramatcher runs Yara rules across every file in the pipeline and tags hits, with the rules themselves deliberately not included.
Two components deserve particular attention from a configuration-extraction standpoint. karton-config-extractor combines Yara rules with operator-written Python modules to pull static malware configurations out of samples — the authors describe it as a fishing rod, not a fish, since the malware-specific modules are not distributed. karton-autoit-ripper wraps AutoIt-Ripper to recover embedded AutoIt scripts from compiled executables. Both fit the framework's philosophy: the plumbing is open, the intel-generating content is yours to supply, which keeps the project clean of anything resembling ready-made tooling for attacking third-party systems.
Persistence and intel sharing are handled by karton-mwdb-reporter, which submits every file, tag, comment and attribute produced along the pipeline into MWDB, CERT-Polska's malware repository. The integration is optional — the README explicitly says writing your own reporter against a different backend is easy — but the pairing of karton and mwdb-core gives a team an end-to-end pipeline from sample ingestion to searchable intelligence with configuration data attached. On the dynamic side, DRAKVUF Sandbox plugs in as an automated black-box analysis stage driven by the agentless DRAKVUF hypervisor-based engine, meaning no instrumentation inside the guest OS.
The community has extended the framework in telling directions. karton-unpacker by c3rb3ru5d3d53c uses the Qiling Framework to unpack common packers like UPX; the same author contributes mwcfg, a modular configuration-extraction utility targeting MalDuck. raw-data provides a Detect-It-Easy classifier and a RetDec-based unpacker, W3ndige builds a modular malware similarity platform, and splintersfury/driver_analyzer shows the framework generalising beyond malware into scalable Windows driver vulnerability analysis — evidence that the task-routing core is genuinely format-agnostic.
For defenders and authorized security teams evaluating karton, the operational value is mostly about taming scale. Incident response and threat hunting generate far more samples than analysts can touch manually, and karton lets each analyst's triage script become a monitored, versioned, centrally-logged service that scales horizontally — run five instances of a consumer and the dispatcher load-balances tasks across them. The karton list -s output showing service and framework versions side by side also gives you upgrade visibility, which matters when a config-extraction module silently breaks after a format change.
From a defensive research and detection perspective, everything karton does happens inside your own infrastructure: samples flow between services you deployed, artifacts land in your S3 bucket, and intel accumulates in your MWDB instance. There is no contact with victim systems, no outbound scanning, and no offensive capability — it is purely a factory for turning raw samples into structured intelligence. Blue teams can therefore adopt it without any of the governance friction that accompanies dual-use tooling.
Caveats worth noting from the README itself: the CLI is intentionally minimal, the Yara rules and config-extraction modules are not shipped, and you are expected to bring your own S3-compatible storage and Redis. That means the real deployment cost is not pip3 install karton-core but designing your pipeline topology and writing the analysis services. The documentation at karton-core.readthedocs.io covers getting started, and the EU Connecting Europe Facility co-financing badge underlines that this is sustained institutional work, not an abandoned repository.
In sum, karton is one of the more thoughtful answers to malware-analysis automation available in open source. Its filter-based task routing, its clean separation of dispatch from consumption, and its healthy ecosystem of first-party and community services make it a strong candidate for any authorized CSIRT, threat-intel team or research lab that has outgrown shell scripts glued together with duct tape and wants its analysts' one-off triage code to become durable, observable infrastructure.
CERT-Polska/karton.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.