Documentation
¶
Overview ¶
Package malware is the engine module for static malware/cryptominer scanning of image layers (CAPABILITY_SPEC domains 3/11, static side). It walks every layer — including files removed by a later whiteout, which remain extractable and are a favorite hiding place — and the flattened tree for filesystem targets, matching each file against the offline signature pack in internal/malware. Findings are DS-RAT-MAL-*.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Module ¶
type Module struct{}
Module implements static malware scanning.
func (*Module) Analyze ¶
Analyze scans the target and returns DS-RAT-MAL findings. An external signature pack can be supplied via Target.Metadata["malware.sigs"]; otherwise the embedded pack is used.
func (*Module) Description ¶
Source Files
Click to show internal directories.
Click to hide internal directories.