Inhale: Malware Analysis and Classification Tool

Inhale: Malware Analysis and Classification Tool

Static analysis of malware can now be easily automated and scaled with Inhale. This tool allows the user to automatically separate malware into different categories depending on their characteristics and see the different properties of the malware being analyzed.

Inhale: Malware Inhaler

Inhale allows the user to rapidly find, classify and store information of a large number of malware files. The user can setup a custom database of malware and add to it easily while also giving them different classifications depending on their properties. Malware can easily be downloaded from internet directories and be included in the database. Inhale extracts a large information from the malware resulting in more than 30 unique properties such as binary format, target OS and the language of the source code.


  • Collect malware from diverse sources
  • Analyze malware and extract more than 30 unique properties
  • Easy to set up and use on a range of systems from research servers to Raspberry Pi
  • Currently the beta version is available
Intesresting in building your own Raspberry Pi GUI? Check this useful article for details and steps.

Future Features:

– Re-doing the bot plugin for Discord / Matrix
– Additional binary analysis features – pulling import/export tables, hashing of specific structures in the header, logging all strings etc.
– Checking if the file is the database before adding. This feature was removed previously due to specific issues with older versions of ES.
– Configuration options for requests such as: user agent, timeout, proxy etc.
– Dockerization of this entire project.

Supported Platforms:

  • Linux


  • Python 3+
  • ElasticSearch
  • Radare2
  • Yara
  • binwalk

Install Prerequisites

Basic steps on installing the prerequisites. You are probably going to encounter some issue during installations, so make sure you check official website for each tool for further details and steps.

Install ElasticSearch (Debian)

$ wget -qO - | sudo apt-key add - 
$ sudo apt-get install apt-transport-https 
$ echo "deb stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list 
$ sudo apt-get update && sudo apt-get install elasticsearch 
$ sudo service elasticsearch start 

Install radare2

$ git clone 
$ cd radare2 
$ sys/ 

binwalk basic installation

$ git clone
$ cd binwalk
$ sudo python3 install

Installing Yara

$ sudo apt-get install automake libtool make gcc $ wget $ tar xvzf v3.10.0.tar.gz $ cd yara-3.10.0/ $ ./ $ ./configure $ make $ sudo make install

Inhale Install

After installing the prerequisites tools/software, clone the GitHub repo:

$ git clone

Navigate to the working directory and install the requirements:

$ cd inhale
$ python3 -m pip install -r requirements.txt

Inhale Usage

Enter the following command:

$ python3 

Available options:

-f infile
-d directory
-u url
-r recursive url
-t TAGS        Additional Tags
-b             Turn off binwalk signatures with this flag
-y YARARULES   Custom Yara Rules
-o OUTDIR      Store scraped files in specific output dir (default:./files//)
-i             Just print info, don't add files to database

Click on the “documentation” button below for more information on usage examples.

Documentation Box
Download Box