Arkana

概要

Malware analysis has traditionally required analysts to master a complex and fragmented toolchain, leading to significant skill barriers, disconnected findings, and repetitive manual tasks. Arkana eliminates these bottlenecks by providing an AI-driven interface to 190 specialized analysis tools, effectively creating an entire malware lab in one MCP server. It enables users to investigate PE, ELF, Mach-O, .NET, Go, Rust, and shellcode samples by simply describing what they want to know in natural language. The AI orchestrates tools for decompilation, emulation, string decoding, YARA scanning, and more, streamlining workflows and allowing the AI to reason over results for enhanced threat intelligence and rapid incident response.

主な機能

• Multi-format support for PE, ELF, Mach-O, .NET, Go, Rust, and raw shellcode
• Angr-powered analysis including decompilation, symbolic execution, and data-flow
• Comprehensive static analysis with YARA, Capa, PEiD, FLOSS signatures, and crypto detection
• Binary Refinery integration for 200+ composable data transforms (encoding, crypto, compression)
• Cross-platform emulation via Speakeasy (Windows APIs) and Qiling (Windows/Linux/macOS, various architectures)
• 2 GitHub stars

ユースケース

• Malware analysts performing deep reverse engineering with natural language queries
• Incident responders rapidly extracting IOCs and C2 configurations from multiple samples
• SOC analysts triaging alerts for automated risk assessment