New nightMARE Python Library to Analyze Malware and Extract Intelligence Indicators

Since its introduction in October 2025, nightMARE has become an essential tool for malware analysts, facilitating both static and dynamic analysis workflows.

Developed by Elastic Security Labs, nightMARE integrates established open-source reverse engineering components under a unified Python API. It utilizes Rizin via rz-pipe for disassembly and the Unicorn engine for lightweight emulation.

This comprehensive design allows researchers to efficiently create configuration extractors, identify Indicators of Compromise (IoCs), and automate analysis tasks. nightMARE was created to reduce code duplication within Elastic’s internal tools, building upon practices refined through extensive sample analyses.

Elastic analysts observed that many proprietary scripts suffered from fragile dependency chains and inconsistent abstractions. By consolidating common patterns like pattern matching, instruction emulation, and cross-reference enumeration, nightMARE offers a robust library for both experienced and novice reverse engineers.

Upon installation, nightMARE provides three primary modules: analysis , core , and malware . The analysis module integrates Rizin for disassembly, hex-pattern searches, and function enumeration. The core module provides utilities for bitwise operations, regex-based extraction, and data casting.

The malware module organizes family-specific extractors—such as Smokeloader and LUMMA —into versioned sub-packages, illustrating real-world API applications. Elastic researchers identified a significant increase in LUMMA campaigns in mid-2025, highlighting the importance of rapid configuration extraction.

nightMARE’s emulation capabilities allow analysts to create a WindowsEmulator, register Import Address Table (IAT) hooks on APIs like Sleep, and execute targeted code sequences efficiently. By intercepting decryption routines in-process, nightMARE automates the recovery of Command and Control (C2) domains without manual unpacking or debugger-driven tracing.

Infection Mechanism and Emulation-Driven Extraction

nightMARE's emulation framework provides a lightweight alternative to full-scale sandboxing . For instance, malware often invokes Sleep before proceeding to C2 decryption. The following code snippet demonstrates how nightMARE's WindowsEmulator hooks Sleep in a LUMMA sample, capturing timing behavior and enabling uninterrupted emulation:

import pathlib from nightMARE.analysis import emulation

def sleephook(emu: emulation.WindowsEmulator, args): print(f"Sleep {emu.unicorn.reg_read(emulation.unicorn.x86_const.UC_X86_REG_ECX)} ms") emu.do_return()

def main(): path = pathlib.Path(r"C:\samples\DismHost.exe") emu = emulation.WindowsEmulator(is_32bits=False) emu.load_pe(path.read_bytes(), stack_size=0x10000) emu.enable_iat_hooking() emu.set_iat_hook(b"KERNEL32.dll!Sleep", sleephook) emu.unicorn.emu_start(0x140006404, 0x140006412)

By intercepting the Sleep call, the emulator bypasses timing obfuscation and resumes execution at the next instruction. Combined with emu.get_data() and emu.get_xrefs_from() , analysts can reconstruct decryption key and nonce addresses, allocate memory buffers, and invoke the malware’s ChaCha20 routine directly.

nightMARE outputs a decrypted list of C2 domains, ready for threat intelligence ingestion. With version 0.16, Elastic Security Labs continues to enhance nightMARE by adding support for additional API hooks, improving pattern-matching accuracy, and refining malware module templates.

As new threats exploit novel obfuscation and packing techniques, nightMARE is prepared to accelerate analysis processes and strengthen the community’s collective defense.

Based on reporting by Cyber Security News.