Open Source & Tools

Azul: Large-Scale Open-Source Malware Analysis Framework Released by ASD

by  • 

Executive Summary

The Australian Signals Directorate (ASD) has released Azul, an open-source malware analysis platform designed for large-scale operational environments including national CERTs, government cyber teams, and large enterprise SOCs.

Azul provides a structured malware repository, an automated analytical engine derived from reverse engineering workflows, and a clustering framework powered by Opensearch. The platform is built to store tens of millions of samples and enable long-term correlation across malware families, infrastructure reuse, and development patterns.

Azul is not a detection engine. Samples must be pre-triaged via binary triage systems, threat hunting, incident response pipelines, or honeypots prior to ingestion.

1. Strategic Positioning

Malware reverse engineering remains resource-intensive:

  • Hours to extract initial IOCs
  • Days to map capabilities
  • Months to deeply understand a malware family

Azul operationalizes repeatable analytical procedures by converting reverse engineering outputs into reusable plugins integrated into automated workflows.

The objective is not to replace expert analysis but to eliminate repetitive manual effort.

2. Core Architecture

2.1 Malware Repository

  • S3-compatible storage backend
  • Designed for tens of millions of samples
  • Configurable metadata ingestion (hostnames, filenames, network telemetry, timestamps, contextual acquisition data)
  • Persistent long-term storage

The repository supports longitudinal malware intelligence.

2.2 Analytical Engine

Once samples are ingested:

  • Reverse-engineering-derived scripts can be automated as plugins
  • Automated extraction of IOCs
  • Static analysis tooling includes:
    • Archive decompression
    • Microsoft Office parsing
    • YARA rule execution
    • Snort signature evaluation
    • Configuration extraction
    • File carving

Plugins can be re-run retroactively when updated, enabling retrospective intelligence enrichment across historical datasets.

2.3 Clustering Suite

Azul leverages Opensearch capabilities to:

  • Identify shared binary features
  • Correlate C2 infrastructure reuse
  • Detect development pattern similarities
  • Group related malware variants

Clustering enhances malware family mapping and campaign tracking.

3. Extensibility

The source code is available through ASD’s ACSC GitHub.

Organizations may:

  • Develop custom plugins
  • Integrate proprietary tooling
  • Design tailored analytical workflows

Azul is architected as an extensible framework rather than a closed product.

4. Operational Limitations

Azul:

  • Does not determine maliciousness
  • Does not replace antivirus engines
  • Does not function as a sandbox detection platform

Pre-triage is mandatory before ingestion.

5. Operational Benefits

For CERT and CTI teams:

  • Reduced repetitive manual analysis
  • Standardized analytical workflows
  • Historical artifact re-analysis
  • Cross-incident correlation
  • Scalable malware intelligence management

PART 2 — ADVANCED TECHNICAL VERSION (REVERSE ENGINEERING ORIENTED)

Azul: Industrializing Malware Reverse Engineering at Scale

Executive Technical Summary

Azul represents a shift from ad-hoc malware reverse engineering toward structured, large-scale analytical automation.

Rather than focusing on dynamic detonation environments, Azul emphasizes:

  • Repository-centric malware intelligence
  • Automated static extraction workflows
  • Feature-based clustering at scale
  • Infrastructure correlation
  • Historical retroactive enrichment

The platform targets environments handling millions of samples per year.

1. Reverse Engineering Workflow Automation

Traditional workflow:

  1. Static triage (hashing, strings, PE headers)
  2. Manual configuration extraction
  3. Network artifact identification
  4. YARA signature development
  5. Family classification
  6. Infrastructure pivoting

Azul converts repeatable outputs of these steps into:

  • Plugin-based automated extraction modules
  • Structured metadata indexing
  • Reusable detection logic

This effectively transforms analyst knowledge into persistent analytical infrastructure.

2. Binary Feature Extraction Strategy

Azul supports automation of:

  • PE header analysis
  • Import table inspection
  • Embedded resource extraction
  • Hardcoded string extraction
  • Configuration blob carving
  • Archive unpacking
  • Microsoft Office macro analysis

Combined with YARA and Snort integration, this allows automated tagging of samples based on structural patterns.

3. Retrospective Intelligence Enrichment

A critical architectural strength is plugin replay.

When a new malware configuration extractor or family-specific decoder is developed:

  • The plugin can be re-executed across historical repositories.
  • Previously unidentified relationships may surface.
  • Latent campaign correlations become visible.

This is particularly valuable in long-lived threat actor tracking.

4. Clustering Methodology

Using Opensearch-based indexing, clustering may rely on:

  • Shared import hashes
  • Shared code fragments
  • Similar configuration schemas
  • Common C2 patterns
  • TLS certificate reuse
  • Embedded infrastructure artifacts

This supports:

  • Malware family consolidation
  • Campaign attribution hypothesis building
  • Infrastructure lifecycle tracking
  • Upstream builder identification

5. Campaign Correlation Capabilities

By integrating:

  • Reverse engineered configuration extraction
  • Network IOCs
  • Infrastructure fingerprinting
  • Metadata indexing

Azul enables:

  • Detection of shared staging servers
  • Identification of builder-level reuse
  • Development cycle mapping
  • Malware variant genealogy reconstruction

6. Scalability Considerations

The system is designed to:

  • Handle tens of millions of samples
  • Maintain long-term retention
  • Operate with distributed storage
  • Support horizontal scaling

This positions Azul closer to a malware intelligence data lake than a traditional sandbox environment.

7. Strategic Implications for National CERTs

For national-level or large enterprise environments:

  • Institutional knowledge becomes codified in plugins
  • Reverse engineering expertise scales across teams
  • Campaign intelligence gains temporal depth
  • Historical re-analysis becomes systematic

Azul shifts reverse engineering from reactive to cumulative intelligence engineering.

References