> ## Content Index
> Fetch the complete content index at: https://itsfoss.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Australia's Cyber Agency Releases Azul, an Open Source Malware Analysis Repository
- URL: https://itsfoss.com/news/azul-malware-analysis-repository/
- Published: 2026-02-24T13:39:11.000Z
- Updated: 2026-02-24T13:39:11.000Z
- Description: Think of it as a searchable, automated knowledge base for malware.
- Author: Sourav Rudra
- Tags: News

The [Australian Signals Directorate](https://www.cyber.gov.au/?ref=itsfoss.com) (ASD) has released [Azul](https://www.cyber.gov.au/business-government/detecting-responding-to-threats/cyber-security-incident-response/azul-malware-analysis-tool?ref=itsfoss.com), a malware analysis platform built for reverse engineers and incident responders. It is the [first public release](https://australiancybersecuritycentre.github.io/azul/overview/release-notes/?ref=itsfoss.com) of the tool, which is now on ***v9.0.0***.

ASD is Australia's signals intelligence agency, which operates under the [Department of Defence](https://www.defence.gov.au/?ref=itsfoss.com). Its Australian Cyber Security Centre (ACSC) handles national cybersecurity guidance and incident response.

Keep in mind that Azul is not [a triage tool](https://www.upguard.com/blog/cybersecurity-triage?ref=itsfoss.com) and does not identify whether a file is malicious. Samples should first be flagged using a tool like the Canadian Centre for Cyber Security's [AssemblyLine](https://github.com/CyberCentreCanada/assemblyline?ref=itsfoss.com) before being fed into Azul.

![an azul implementation is showcased here with details of a selected binary visible](https://itsfoss.com/content/images/2026/02/azul-malware-analysis-tool-demo.png)

**This demo image of Azul was sourced from* [**the documentation*](https://australiancybersecuritycentre.github.io/azul/user-guide/malware-analysis/?ref=itsfoss.com)**.*

The platform is built using **Python**, **Golang**, and **TypeScript**. It runs on [Kubernetes](https://linuxhandbook.com/courses/kubernetes/?ref=itsfoss.com) via [Helm](https://helm.sh/?ref=itsfoss.com) chart templates, uses [Apache Kafka](https://kafka.apache.org/?ref=itsfoss.com) for event queuing, and stores samples in an [S3](https://aws.amazon.com/s3/?ref=itsfoss.com)\-compatible object store.

Monitoring and alerting are supported through [Prometheus](https://prometheus.io/?ref=itsfoss.com), [Loki](https://grafana.com/oss/loki/?ref=itsfoss.com), and [Grafana](https://grafana.com/?ref=itsfoss.com). Azul also ships with a web interface, an HTTP REST API, and a headless client for integration with external systems.

It supports [YARA](https://virustotal.github.io/yara/?ref=itsfoss.com) rules, [Snort](https://www.snort.org/?ref=itsfoss.com) signatures, and the [Maco](https://github.com/CybercentreCanada/Maco?ref=itsfoss.com) framework for malware configuration extraction. Malware sample access is controlled via [OpenID Connect](https://openid.net/developers/how-connect-works/?ref=itsfoss.com).

## The Components

Azul has three main components. The **malware repository** stores samples with origin metadata, including hostnames, filenames, network details, and timestamps, and is designed to retain everything indefinitely provided ample storage is provided.

The **analytical engine** lets teams turn reverse engineering work into reusable plugins that run automatically. When a plugin is updated, it can be re-run against historical samples, which can surface new findings from past incidents.

The **clustering suite** uses [OpenSearch](https://opensearch.org/?ref=itsfoss.com) to find patterns across samples, helping analysts identify shared infrastructure, development patterns, and behavioral similarities. It also pulls in data from industry reporting to strengthen those findings.

## The Source Code

The source code for Azul can be found on [GitHub](https://github.com/AustralianCyberSecurityCentre/azul?ref=itsfoss.com), licensed under **MIT**. The repository includes a *README* to get you started. Full documentation covering installation and developer guides is hosted on the official [Azul docs portal](https://australiancybersecuritycentre.github.io/azul/?ref=itsfoss.com).

[Azul](https://github.com/AustralianCyberSecurityCentre/azul?ref=itsfoss.com)

---

**Suggested Read 📖:** [*Reverse Engineering Linux Distro REMnux Marks 15 Years*](https://itsfoss.com/news/remnux-v8-release/)

[Reverse Engineering Linux Distro REMnux Marks 15 Years With Major v8 Release Featuring AI Agent SupportMalware analysis Linux distro gets Ubuntu 24.04 base, a new installer, and many new tools.![](https://itsfoss.com/content/images/icon/android-chrome-512x512-293.png)It's FOSSSourav Rudra![](https://itsfoss.com/content/images/thumbnail/remnux-v8-release-banner.png)](https://itsfoss.com/news/remnux-v8-release/)