binwalk

binwalk -e <sample>

Analyze and extract embedded files from a firmware image or binary with binwalk, finding what is hidden inside.

Run it when the binary is not what it seems: binwalk scans the file for known signatures (filesystems, compression, images, executables) and -e extracts the embedded components — the router firmware with its filesystem, the installer with hidden binaries, the dropper with the embedded payload. It is the tool for firmware analysis and binaries with embedded content. In IR, binwalk is the step that pulls out what is inside: the dropper payload, the compromised firmware scripts, the modified libraries.

Do not use it as malware analysis: binwalk extracts content, it does not determine maliciousness — the extracted files are analyzed afterwards (YARA, capa, sandbox). Binwalk signatures fail with new or modified formats: the absence of detection does not mean there is no embedded content. And watch out for performance and safety: extracting large images (GB-sized firmware) takes time and generates many files; and analyzing compromised firmware on the work host is a risk — the sandbox or an isolated VM is the place. For known formats (squashfs, ext), extraction with the specific tools is an alternative.