anticuckoo

anticuckoo 一款用于检测并崩溃Cuckoo Sandbox的工具。已在Cuckoo Sandbox官方和Accuvant的Cuckoo版本中测试。 请考虑捐赠：https://github.com/sponsors/therealdreg Anticuckoo 也能检测其他沙盒，如 FireEye（-c2）： Reddit / netsec 上关于 anticuckoo 的讨论 功能 检测: Cuckoo钩子检测（所有类型的Cuckoo钩子）。 自身内存中的可疑数据（不使用API，逐页扫描）。 崩溃（带参数执行）（在沙盒外这些参数不会使程序崩溃）： -c1：修改被钩API的RE...

cuckoo-modified

これは、GPLのもとで提供されているCuckoo Sandboxの大幅に修正されたバージョンです。 上流のCuckooに比べて、以下のような多くの利点があります。 完全に正規化されたファイル名とレジストリ名 64ビット解析 WoW64ファイルシステムリダイレクトの処理 多くの追加APIフック サービスの監視 APIコールをマルウェアのコールチェーンに関連付け APCインジェクションとステルスエクスプローラインジェクションを追跡する機能 整形されたAPIフラグ 分析ごとのTorサポート 150以上の新しいシグネチャモジュール（75以上）...

cuckooautoinstall

关于CuckooAutoinstall Cuckoo Sandbox 自动安装脚本 什么是Cuckoo Sandbox？ Cuckoo Sandbox 是一个恶意软件分析系统。 这意味着什么？ 这意味着你可以将任何可疑文件丢进去，然后获得一份报告，详细说明该文件在隔离环境中的行为。 我们最初在 Buguroo Offensive Security 创建这个脚本，目的是让痛苦的 Cuckoo 安装过程变得更快、更简单、更无痛。 支持的系统 本脚本大部分不依赖发行版（当然你必须在 GNU/Linux 上运行它），但在软件包安装方面，目前仅支持 Debian 衍生版。 另外，由于我们使用专有的...

cuckoo-droid

CuckooDroid - 自動化されたAndroidマルウェア解析。 Check Point Software Technologies LTD. より提供。 CuckooDroidは、疑わしいファイルの解析を自動化するオープンソースソフトウェアCuckoo Sandboxの拡張であり、CuckooにAndroidアプリケーションの実行と解析機能をもたらします。 インストール - 簡単な統合スクリプト: root@kitploit: git config --global user.email "[email protected]" git config --global...

cuckooautoinstall

About CuckooAutoinstall Cuckoo Sandbox . auto install script What is Cuckoo Sandbox? Cuckoo Sandbox is a malware analysis system. What does that mean? It means that you can throw any suspicious file at it and get a report with details about the file's behavior inside an isolated environment. We...

Log4Shell-Sandbox-Signature

Log4Shell-Sandbox-Signature Log4ShellCVE-2021-45046 サンドボックスシグネチャ 正規表現 : https://github.com/back2root/log4shell-rex Cape サンドボックスシグネチャ Cuckoo サンドボックスシグネチャ...

volatility

This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3 ============================================================================ Volatility Framework - Volatile memory extraction utility framework The Volatility Framework is a...

cuckoo

.. image:: https://cuckoosandbox.org/assets/images/cuckoo-black.png :alt: Cuckoo Sandbox :target: https://cuckoosandbox.org/ TENGA EN CUENTA: Cuckoo Sandbox 2.x actualmente no recibe mantenimiento. Es muy probable que las incidencias abiertas o las pull requests no se procesen, ya que actualmente...

UPDATE: Cuckoo Sandbox 2.0.7

PenTestIT RSS Feed It has been some time that I posted about the Cuckoo Sandbox. Good news is that the guys at the Cuckoo Foundation are not silent and have released the Cuckoo Sandbox 2.0.7, with lots of improvements, code cleanup, support for VirtualBox 6 and the well deserved support for the...

VirusTotal launches 'Droidy' sandbox to detect malicious Android apps

One of the biggest and most popular multi-antivirus scanning engine service has today launched a new Android sandbox service, dubbed VirusTotal Droidy, to help security researchers detect malicious apps based on behavioral analysis. VirusTotal, owned by Google, is a free online service that allow...

UPDATE: Cuckoo Sandbox 2.0.4

PenTestIT RSS Feed My previous post was about this open source, malware analysis automation framework - Cuckoo Sandbox 2.0.0. This post however, is about an update made to the framework. We now have Cuckoo Sandbox 2.0.4 which include a number of important improvements simplifying and improving yo...

Automated Android Malware Analysis: CuckooDroid

CuckooDroid is an extension of Cuckoo Sandbox the Open Source software for automating analysis of suspicious files. CuckooDroid brigs to cuckoo the capabilities of execution and analysis of android application. CuckooDroid is an automated, cross-platform, emulation and analysis framework based on...

CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox

CuckooDroid is an extension of Cuckoo Sandbox the Open Source software for automating analysis of suspicious files, CuckooDroid brigs to cuckoo the capabilities of execution and analysis of android application. Installation - Easy integration script: git config --global user.email...

Cuckoo Sandbox Guest 2.0.1 Code Execution

-- coding: utf8 -- """ Exploit Title: Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC Date: June 28th 2016 Exploit Author: Rémi ROCHER Vendor Homepage: https://cuckoosandbox.org/ Software Link: https://github.com/cuckoosandbox/cuckoo/archive/master.zip Version: = 2.0.1 Tested on: MS Windows 7, MS...

Cuckoo Sandbox Guest 2.0.1 - XMLRPC Privileged Remote Code Execution

Exploit for windows platform in category local exploits -- coding: utf8 -- """ Exploit Title: Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC Date: June 28th 2016 Exploit Author: Rémi ROCHER Vendor Homepage: https://cuckoosandbox.org/ Software Link:...

Cuckoo Sandbox Guest 2.0.1 - XMLRPC Privileged Remote Code Execution

-- coding: utf8 -- """ Exploit Title: Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC Date: June 28th 2016 Exploit Author: Rémi ROCHER Vendor Homepage: https://cuckoosandbox.org/ Software Link: https://github.com/cuckoosandbox/cuckoo/archive/master.zip Version: = 2.0.1 Tested on: MS Windows 7, MS...

Cuckoo Sandbox Guest 2.0.1 - XMLRPC Privileged Remote Code Execution

Cuckoo Sandbox Guest 2.0.1 - XMLRPC Privileged Remote Code Execution -- coding: utf8 -- """ Exploit Title: Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC Date: June 28th 2016 Exploit Author: Rémi ROCHER Vendor Homepage: https://cuckoosandbox.org/ Software Link:...

AntiCuckoo - A Tool to Detect and Crash Cuckoo Sandbox

A tool to detect and crash Cuckoo Sandbox. Tested in Cuckoo Sandbox Official and Accuvant's Cuckoo version. Features Detection: Cuckoo hooks detection all kind of cuckoo hooks. Suspicius data in own memory without APIs, page per page scanning. Crash Execute with arguments out of a sandbox these...

Malware Evasion Techniques Dissected at Black Hat

Malware ingenuity isn’t limited to its functionality or its ability to propagate. Sometimes malicious code has to have guile to survive. That means for the most part having an innate understanding of when it’s being analyzed by a security expert. Numerous samples from different malware families...

[Malwasm] Offline debugger for malware's reverse engineering

Malwasm is a tool based on Cuckoo Sandbox available here. Malwasm was designed to help people that do reverse engineering. Malwasm step by step: the malware to analyse is executed through Cuckoo Sandbox during the execution, malwasm logs all activites of the malware with pintool all activities ar...