[ COMING SOON ]

MODGUD

YOUR MALWARE WORKBENCH

A local-first triage workbench for people who don't send their samples anywhere. Landing soon.

OFFLINE BY DEFAULT DETERMINISTIC NPU-ACCELERATED

in active development · closed alpha · Linux

[ A GLIMPSE ] One workbench for the whole triage flow.

LOCAL BY DEFAULT, YOUR CALL

A local model runs out of the box. Bring your own API if you want more.

✓

Sample bytes never leave your machine — not on the local model, not on a remote one. The binary stays in quarantine.

✓

Remote inference is strictly opt-in. Enable it and only finding-derived text (functions, strings, findings) is sent — the app tells you exactly what, each time.

✓

Your API key is encrypted in the OS keychain — never written to disk in plaintext, reports, exports, or logs.

WHY MODGUD

Built for offline analysis.

◈

Offline by default

Samples are copied into an encrypted, SHA-256-keyed quarantine and analyzed on-device. No account, no telemetry, and no network calls unless you configure one. Air-gap friendly.

◆

Deterministic verdicts

The score comes from corroborating signals — not a black box. The local LLM narrates findings and explains code, but it never decides the verdict.

◇

NPU-accelerated

Static passes and the assistant run on your neural processor — fast enough to triage a queue without a GPU rig or a cloud bill.

▤

Static → dynamic

YARA byte scans, Sigma coverage and authored KQL — then detonate in an isolated sandbox to confirm behavior with real Device*Events telemetry.

⌘

RE assistant

Pseudo-C decompilation, xrefs and a grounded assistant that explains functions and drafts YARA — scoped to whatever you're looking at.

◱

Corpus intelligence

Every analysis is a project. Across them, see language breakdowns, ATT&CK coverage, exploited CVEs and heuristic actor clusters.