cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 11

NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi,

Under maintenance within NSM there is a Malware Archive section, here you can export a cached malware file under the format of "HASH.mcafee".

Is there anyway to recover the original file from this?

I'm interested in running the originals through sandbox products like DeepViz and Hybrid Analysis but can't see to retrieve the original or convert the file into any acceptable format.

Some sandbox files will capture files you can download and run independently to determine their reputation/contents.

Usually you get a file that you need to rename to a .zip format, from there you can uncompress it and rename the files inside to their original extensions and you now have the original file.

Is this possible with the .mcafee files?

Thanks,

1 Solution

Accepted Solutions
petermason
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi James,

There is a tool called MalwareDecrypter.bat on the manager in the \app\diag\malwareUtil folder that you use to un-encrypt these files.

Details of how to use it are on P214 of the NSP_82_Manager_Administration_Guide_revJ_en-us document available here;

Network Security Platform documentation reference guide

https://kc.mcafee.com/agent/index?page=content&id=KB76064

Regards

Peter

View solution in original post

10 Replies
petermason
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi James,

There is a tool called MalwareDecrypter.bat on the manager in the \app\diag\malwareUtil folder that you use to un-encrypt these files.

Details of how to use it are on P214 of the NSP_82_Manager_Administration_Guide_revJ_en-us document available here;

Network Security Platform documentation reference guide

https://kc.mcafee.com/agent/index?page=content&id=KB76064

Regards

Peter

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi Peter,

I used the MalwareDecypter.bat tool to un-encrypt the archived malware, but I only see the tmp folder is created, not anything be found. Pls support me.

petermason
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi James,

What version of the NSP software are you running?

When you run the MalwareDecrypter.bat utility is it giving you a message to say it was successful?

What if the full command you are running?

Regards

Peter

Former Member
Not applicable
Report Inappropriate Content
Message 5 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi Peter,

I running the NSP version 8.2.7.83

Below is the result after I enter command. I tried use <file name>.mcafee or <file name> only, but the result is the same

cmd.jpg

petermason
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 6 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi Stonewall

You need to use the File Type and File Hash that you see in the manager, not the actual name of the archive file.

Examples from the Admin guide

The utility tool can be run using one of the following combinations of commands and parameters:

• To decrypt a specific file: MalwareDecrypter.bat "FILE_TYPE" FILE_HASH

Example: MalwareDecrypter.bat "PDF Files" 01234567890123456789012345678901

• To decrypt all files of a specific file type: MalwareDecrypter.bat "FILE_TYPE"

Example: MalwareDecrypter.bat "PDF Files"

• To decrypt all files: MalwareDecrypter.bat *

The decrypted malware file is stored in the aforementioned location (C:\Program Files\McAfee\Network Security Manager\App\temp\tftpin\malware\tmp) in a folder named after the family classification of the file type and not the file type name itself.

Former Member
Not applicable
Report Inappropriate Content
Message 7 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi Peter,

Your explanation is very helpful. Thanks so much.

I have one more question. My customer separately build the Operator team and Security team. The security team only permitted access to Web GUI. That mean, to analyze malware, They must be approlved RDP to NSM server, right? Could you share me your recommendation.

petermason
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 8 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi Stonewall,

You could share the folder containing the malware archives on the server and just give them permissions to read the files directly from that folder, they could just connect using a UNC path.

Regards

Peter

Former Member
Not applicable
Report Inappropriate Content
Message 9 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi Peter

Apologize for my inconvenience. The malware archives encrypted they must be decrypted manually on NSM server before analyze. Who will do it? The Sec team can't do it on a UNC path. If it is Operator team, they aren't available 24/7 to process the request from Sec team. Sorry if my think is wrong.

petermason
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 10 of 11

Re: NSM - Malware Archive - Decompressing Export Files

Jump to solution

Hi Stonewall,

You could try writing a script to run the MalwareDecrypter.bat utility periodically to uncompress the files. Then they could be copied by the Security Team from the server.

You could also try to use the MalwareDecrypter.bat tool on a standalone machine to decompress the files, I don't know if it has any dependencies but you could contact McAfee Support if you have questions.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community