Michael Boman

Cuckoo Sandbox on Hardware: Installing the OS and required guest utils on the hardware node

2013-06-17T23:16:00.000+02:00

This is the second blog post about running Cuckoo Sandbox on hardware nodes instead of virtual machines, and thus removing the whole "prevent detection of virtual machine" issue that malware authors creates when trying to avoid detection. The drawback is the number of samples a single machine can analyze.

Previously I walked through the steps on how to install FOG server in a OpenVZ environment. In this post I will walk through the steps of preparing the computer so you can restore it to a known state. For practical reasons I am using a virtual machine to document this, but the steps are exactly the same I use for my hardware node (apart from hard drive size).

Installing the OS

For this hardware node I am using Windows 7 Enterprise as the target OS, but you can use any OS supported by both FOG Project and Cuckoo Sandbox (Basically any modern Windows OS).

First we choose the language and keyboard layout.

Choose "Install now".

Setup is starting

Accept the license agreement. I have access to a enterprise license for Windows 7, thanks to a anonymous sponsor.

Choose "Custom (advanced)".

Select your disk and click on "Drive options (advanced)" to view the advanced disk menu items.

Create a new partition that fills up the disk (you can choose to create a smaller partition then the whole disk if you want. If your FOG Server is low on disk space it might be a good idea to do so.

Windows installation is copying files to the hard drive.

Create the first user and name the computer.

IMPORTANT: Create a password for the new account.

Turn off automated updates. It is important that the guest doesn't perform any configuration changes that might show up in the activity logs when the analysis runs.

Configure time and date.

Windows installer is performing the last few changes.

Tada! Windows 7 is installed.

Turning off UAC (User Account Control)

To user Control Panel to disable UAC in Windows 7, there are several methods to access the User Account Control settings page:

Go to Start Menu -> Control Panel -> User Accounts and Family Safety -> User Account.

Slide the slider bar to the lowest value (towards Never Notify), with description showing Never notify me.

Click OK to make the change effective.

Restart the computer to turn off User Access Control.

Installing FOG guest utils

Go to your FOG server to download the FOG client utilities from http://fogserver/fog/client/. If you are like me using Windows 7 as the guest OS then you need to download FOG Prep as well.

Download "FOG Client Service" (FogService.zip).

Once downloaded extract the archive.

Once extracted run the "setup" program and follow the on-screen instructions.

I remove the AutoLogOut module, as I want to have my user logged in all the time.

As I mentioned earlier, Windows 7 requires the "FOG Prep" utility as well. Download the "FogPrep.zip" archive and extract it.

I copied the FogPrep executable over to the FOG service directory (C:\Program Files\FOG) to keep all the FOG related components in the same place.

This concludes the FOG portion of the guest installation.

Installing Cuckoo Sandbox Agent

For the Cuckoo Sandbox agent the steps are the same as in a virtual machine: Install Python and optionally PIL (Python Image Library) if you wish to grab screenshots (highly recommended).

Installing Python and PIL (Python Image Library)

Go to http://www.python.org/ and download Python 2.7.

Once downloaded run the installation program.

Go to http://www.pythonware.com/products/pil/ and download PIL for Python 2.7.

Start the installation once the download is completed.

You have now Python and the additional PIL component installed.

Installing the Cuckoo Sandbox Agent

Now when you have Python and PIL installed it is time to install the Cuckoo agent, although "installing" might be a too big word. You need to download "agent.py" from the Cuckoo's "agent" directory on your management machine. This can be done in several ways, using everything from USB flash drives to shared network drives.

I place a shortcut from the agent.py into the "Startup" folder so the agent starts automatically at login.

Make the Cuckoo user logon automatically

To make the user login automatically click on Start and then enter the following command in the search box:

netplwiz

and press the ENTER key. You can also run this command from a command prompt as well.

This command will load the Advanced User Accounts Control Panel applet.

In the Users tab, uncheck the box next to Users must enter a user name and password to use this computer. Click on the Apply button at the bottom of the User Accounts window.

When the Automatically Log On dialog box appears, enter the user name you wish to automatically login to Windows 7 with. Then enter your account password in the two fields where it's asked.

Exit the Advanced User Accounts Control Panel applet by clicking "OK" to all the open windows.

Now the user account will login automatically and run the Cuckoo agent at boot up.

This concludes the OS and guest utilities installation for Cuckoo Sandbox on hardware nodes. Stay tuned for the next installment of this article series. Please provide feedback in the comments.

Weekly malware statistics between 2013-06-09 and 2013-06-16

2013-06-17T12:45:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is scientifically pretty flawed for several reasons, so the information provided should not be used for anything important (like selecting a AV-vendor).

Here is a short list of known problems with the statistics:

The underlying assumptions for what is malware is not scientifically accurate. If a AV-vendor mistakenly flag a sample as malicious then all other vendors is accused of failing to detect the sample. For better accuracy the number of vendors that thinks a sample is malicious should be increased, but to what?
I have a limited sample gathering and analysis capability and I am not even sure I get a decent amount of fresh malware, thus the sample collection is not scientifically accurate.
VirusTotal (the service I use to perform the analysis) does not run the sample but only scans the dormant file which means that anti-malware products that detects the execution of the sample is unfairly treated as not detecting the sample, even if it would have done so in a real-life scenario.
The post is automatically generated and has not been viewed before posting, so no underlying analysis of the result has been performed.

A total of 5936 samples was analyzed between 2013-06-09 and 2013-06-16.
33 samples was not deemed malicious by VirusTotal at the time of analysis.
1367 samples was not scanned by VirusTotal before at the time of analysis.

File Analysis

A total of 5936 file samples was analyzed between 2013-06-09 and 2013-06-16.
33 file samples was not deemed malicious by VirusTotal at the time of analysis.
1367 file samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection ratio
Ikarus	3829	84%
AntiVir	3814	84%
GData	3804	83%
Emsisoft	3787	83%
Avast	3701	81%
McAfee-GW-Edition	3626	79%
VIPRE	3611	79%
F-Secure	3590	79%
BitDefender	3584	79%
Comodo	3567	78%
McAfee	3496	77%
Kaspersky	3471	76%
AVG	3414	75%
K7AntiVirus	3363	74%
DrWeb	3330	73%
Fortinet	3293	72%
TrendMicro-HouseCall	3236	71%
Norman	3223	71%
Microsoft	3207	70%
Symantec	3102	68%
Sophos	3016	66%
TrendMicro	2896	63%
nProtect	2861	63%
F-Prot	2776	61%
Commtouch	2759	60%
Jiangmin	2720	59%
PCTools	2586	57%
VBA32	2530	55%
Panda	2500	55%
AhnLab-V3	2465	54%
VirusBuster	2412	53%
NOD32	2266	49%
TheHacker	2223	49%
CAT-QuickHeal	1924	42%
Rising	1843	40%
ClamAV	1841	40%
eSafe	1742	38%
ESET-NOD32	1238	27%
SUPERAntiSpyware	1224	26%
Antiy-AVL	1210	26%
eTrust-Vet	1202	26%
TotalDefense	1100	24%
ViRobot	902	19%
Agnitum	568	12%
MicroWorld-eScan	505	11%
Kingsoft	436	9%
NANO-Antivirus	362	7%
Malwarebytes	255	5%
ByteHero	246	5%
K7GW	104	2%
Avast5	21	0%
eScan	19	0%
Prevx	7	0%
Command	1	0%

URL Analysis

A total of 0 URL samples was analyzed between 2013-06-09 and 2013-06-16.
0 URL samples was not deemed malicious by VirusTotal at the time of analysis.
0 URL samples was not scanned by VirusTotal before at the time of analysis.

No URLs has been analysed during the selected period.
- Mallory Rasputin, overworked and underpaid malware research intern.
You can reach me at research@michaelboman.org.

Weekly malware statistics between 2013-06-02 and 2013-06-09

2013-06-10T18:05:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is scientifically pretty flawed for several reasons, so the information provided should not be used for anything important (like selecting a AV-vendor).
Here is a short list of known problems with the statistics:

The underlying assumptions for what is malware is not scientifically accurate. If a AV-vendor mistakenly flag a sample as malicious then all other vendors is accused of failing to detect the sample. For better accuracy the number of vendors that thinks a sample is malicious should be increased, but to what?
I have a limited sample gathering and analysis capability and I am not even sure I get a decent amount of fresh malware, thus the sample collection is not scientifically accurate.
VirusTotal (the service I use to perform the analysis) does not run the sample but only scans the dormant file which means that anti-malware products that detects the execution of the sample is unfairly treated as not detecting the sample, even if it would have done so in a real-life scenario.
The post is automatically generated and has not been viewed before posting, so no underlying analysis of the result has been performed.

A total of 11774 samples was analyzed between 2013-06-02 and 2013-06-09.
387 samples was not deemed malicious by VirusTotal at the time of analysis.
2463 samples was not scanned by VirusTotal before at the time of analysis.

File Analysis

Engine	Detected samples	Detection ratio
Ikarus	1741	86%
GData	1719	85%
Emsisoft	1719	85%
Avast	1685	83%
AntiVir	1682	83%
Comodo	1642	81%
BitDefender	1641	81%
F-Secure	1630	81%
McAfee-GW-Edition	1622	80%
Kaspersky	1598	79%
McAfee	1572	78%
AVG	1549	76%
VIPRE	1546	76%
TrendMicro-HouseCall	1521	75%
K7AntiVirus	1511	75%
Fortinet	1504	74%
DrWeb	1479	73%
Microsoft	1462	72%
Symantec	1447	71%
Norman	1439	71%
Sophos	1420	70%
TrendMicro	1374	68%
F-Prot	1330	66%
nProtect	1326	65%
Commtouch	1317	65%
Jiangmin	1280	63%
PCTools	1238	61%
Panda	1200	59%
AhnLab-V3	1146	56%
VBA32	1101	54%
TheHacker	1026	50%
CAT-QuickHeal	922	45%
VirusBuster	889	44%
eSafe	862	42%
NOD32	850	42%
ClamAV	835	41%
Rising	828	41%
ESET-NOD32	684	33%
Antiy-AVL	625	31%
TotalDefense	611	30%
SUPERAntiSpyware	547	27%
Agnitum	489	24%
MicroWorld-eScan	458	22%
ViRobot	452	22%
eTrust-Vet	447	22%
NANO-Antivirus	445	22%
Kingsoft	350	17%
Malwarebytes	162	8%
ByteHero	100	4%
K7GW	75	3%
eScan	13	0%
Avast5	10	0%
Webwasher-Gateway	1	0%
Sunbelt	1	0%
McAfeeBeta	1	0%
McAfee+Artemis	1	0%

URL Analysis

Engine	Detected samples	Detection ratio
CLEAN MX	5338	77%
BitDefender	5082	73%
Fortinet	4141	59%
Sophos	3690	53%
SCUMWARE_org	3058	44%
Google Safebrowsing	2719	39%
Websense ThreatSeeker	2527	36%
Yandex Safebrowsing	2479	35%
ADMINUSLabs	2207	31%
Antiy-AVL	2190	31%
Dr_Web	1419	20%
Avira	995	14%
ESET	940	13%
Kaspersky	691	9%
K7AntiVirus	590	8%
ParetoLogic	225	3%
Netcraft	213	3%
Comodo Site Inspector	201	2%
Opera	195	2%
G-Data	118	1%
AlienVault	82	1%
C-SIRT	67	0%
Malc0de Database	42	0%
SecureBrain	28	0%
Phishtank	23	0%
Sucuri SiteCheck	17	0%
Minotaur	13	0%
zvelo	8	0%
Quttera	4	0%
MalwarePatrol	1	0%

- Mallory Rasputin, overworked and underpaid malware research intern.
You can reach me at research@michaelboman.org.

Weekly malware statistics between 2013-05-26 and 2013-06-02

2013-06-03T21:48:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 13310 samples was analyzed between 2013-05-26 and 2013-06-02.
446 samples was not deemed malicious by VirusTotal at the time of analysis.
3635 samples was not scanned by VirusTotal before at the time of analysis.

File Analysis

No files has been analysed during the period in question.

URL Analysis

Engine	Detected samples	Detection ratio
Fortinet	6661	72%
BitDefender	3374	36%
Sophos	2432	26%
Websense ThreatSeeker	2313	25%
SCUMWARE_org	2115	22%
ADMINUSLabs	1571	17%
Yandex Safebrowsing	1075	11%
Antiy-AVL	1058	11%
ParetoLogic	875	9%
Google Safebrowsing	861	9%
ESET	838	9%
K7AntiVirus	797	8%
C-SIRT	688	7%
Dr_Web	455	4%
CLEAN MX	425	4%
Kaspersky	130	1%
Minotaur	122	1%
Sucuri SiteCheck	76	0%
AlienVault	68	0%
Phishtank	67	0%
Comodo Site Inspector	67	0%
Opera	65	0%
Netcraft	65	0%
CyberCrime	65	0%
Malc0de Database	4	0%
G-Data	4	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Cuckoo Sandbox on Hardware: Installing the clone management server

2013-06-03T20:35:00.000+02:00

The first piece of the puzzle is a cloning server, and for this I am using the FOG Project. The task of the cloning server is to re-install the hardware node to a know good state (like "revert to snapshot" on virtual machines, or perhaps cloning a new virtual machine from template (like what my "CloneAndAdd.py" script does).

I am running the FOG Server in a Ubuntu OpenVZ container on my Proxmox VE system. Because it is running in a container I need to use the user-space instead of the kernel-space NFS server, but I have documented both parts here.

Installing FOG Project server in a OpenVZ container

Follow these instructions if you want to install FOG in a OpenVZ container, else install FOG on a separate machine or as a VirtualBox/VMWare/etc. VM. I choose OpenVZ as I already have a Proxmox VE installed that takes care of all "infrastructure" services like firwall, DNS etc. Your mileage may vary.

Creating a Ubuntu OpenVZ container

First you need to create a OpenVZ container. You do this by pressing "Create CT" in the upper right corner in the Proxmox VE GUI.

A wizard will start to guide you though the container creation.

General: First we need to provide a Hostname and a password for the "root" user account.

Template: In the second step we need to specify what template you want to use for the container. I choose 32-bit Ubuntu 12.04, which is the latest LTS-release as of this writing. Please refer to the Proxmox VE Wiki for information on how to obtain OpenVZ templates for Proxmox VE.

Resources: We need to specify how much resources we should give this new container. I kept RAM and SWAP at default 512 MB each, but increased the disk space to 100 Gb (it is not pre-allocated so it will only use what it actually needs).

Network: I choose bridged mode and the correct bridge interface for his machine.

DNS: I left the DNS settings as default so Proxmox VE will use the system wide settings.

Confirm: Confirm the chosen settings

Template extraction begins. Wait until it has been completed.

Congratulations, you have now a standard 32-bit Ubuntu system in a OpenVZ container.

Enabling networking

Once the OpenVZ container has been created you need to start it up. Once booted you can use the Java console to enter the system and configure networking. I am using DHCP with static leases to manage the systems IP networking. That way I can just make a quick change in my DHCP server if I need to change my subnet prefix.
Updating the system

Once you have the system running and some network connectivity it is a good time to make sure the system is up-to-date. The process is like any other Debian/Ubuntu based system:

# apt-get update# apt-get dist-upgrade
Downloading FOG Server

So now we have an up-to-date Ubuntu installation. Time to make it a FOG Project server. Download the FOG Project source from http://www.fogproject.org/ and unpack it, like this:

# wget -O fog_0.32.tar.gz http://sourceforge.net/projects/freeghost/files/FOG/fog_0.32/fog_0.32.tar.gz/download# tar xzf fog_0.32.tar.gz
Unfortunately the kernel-space NFS server, which is default in Ubuntu, doesn't work so good in a OpenVZ container - mainly because OpenVZ containers does not have their own kernel. To fix this we need to do two this: Modify the FOG Project installation script and install a user-space NFS server (unfs3).

Modifying FOG Server installation script to support OpenVZ

Edit the fog_0.32/lib/ubuntu/config.sh file and change any reference of nfs-kernel-server to unfs3.

You also need to modify the resulting /etc/exports file because unfs3 doesn't work with wildcards. You do this by modifying the configureNFS() function in fog_0.32/lib/ubuntu/functions.sh file and replace the

echo "/images *(ro,sync,no_wdelay,insecure_locks,no_root_squash,insecure)
/images/dev *(rw,sync,no_wdelay,no_root_squash,insecure)" > "${nfsconfig}";

lines with net addresses, like this:

echo "/images 192.168.1.0/255.255.255.0(ro,sync,no_wdelay,insecure_locks,no_root_squash,insecure)
/images/dev 192.168.1.0/255.255.255.0(rw,sync,no_wdelay,no_root_squash,insecure)" > "${nfsconfig}";

You will also need to replace the following lines:

sysv-rc-conf nfs-kernel-server on >/dev/null 2>&1;
/etc/init.d/nfs-kernel-server stop >/dev/null 2>&1;
/etc/init.d/nfs-kernel-server start >/dev/null 2>&1;

with

sysv-rc-conf unfs3 on >/dev/null 2>&1;
/etc/init.d/unfs3 stop >/dev/null 2>&1;
/etc/init.d/unfs3 start >/dev/null 2>&1;

Save and quit your editor of choice.

Installing user-space NFS-server

Unfortunately Ubuntu has stopped shipping the user-space NFS server unfs3, we we need to build the package ourselves. Don't worry, it is quite easy to do that - just follow the instructions here.

Downloading

Go to http://mirror.fsf.org/trisquel/pool/main/u/unfs3/ and download the files unfs3_0.9.22+dfsg-2.diff.gz, unfs3_0.9.22+dfsg-2.dsc and unfs3_0.9.22+dfsg.orig.tar.gz. Once downloaded unpack the unfs3_0.9.22+dfsg.orig.tar.gz archive like this:

# tar xzf unfs3_0.9.22+dfsg.orig.tar.gz

then enter the unpacked directory and apply the unfs3_0.9.22+dfsg-2.diff.gz patch, like this:
# zcat unfs3_0.9.22+dfsg-2.diff.gz | patch -p0

Packaging

Once the source is patched we will create a .deb using the following command:

# cd unfs3-0.9.22+dfsg/
# dpkg-buildpackage

To build unfs3 you need to have build-essential installed. You may also need to install additional build dependencies, as directed.

Installing

Once the unfs3 package is created you install it like this:

# dpkg -i ../unfs3_0.9.22+dfsg-2_i386.deb

We have now a user-space NFS-server (unfs3) running in a OpenVZ container. Good job! If it fails to start make sure that portmap (/etc/init.d/portmap) is started.

Installing FOG Project

The final step is to actually install the FOG Project server itself. Luckily it is a very straight-forward process now that we have prepared everything else:

# cd fog_0.32/bin/
# ./installfog.sh

Follow the on-screen instructions. As I already have a DHCP-server I reconfigured it to serve FOG Project needs as described at http://www.fogproject.org/wiki/index.php?title=Modifying_existing_DHCP_server_to_work_with_FOG.

After the installation your FOG Server is now running:

Conclusions

We have now a FOG Project server that will allow us to create and restore physical systems. In the next blog post in the series we will walk through the installation of the physical node and the dependent software.

Weekly malware statistics between 2013-05-19 and 2013-05-26

2013-05-27T02:00:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 13345 samples was analyzed between 2013-05-19 and 2013-05-26.
562 samples was not deemed malicious by VirusTotal at the time of analysis.
3296 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
Fortinet	6653	70%
BitDefender	2510	26%
Sophos	2376	25%
Websense ThreatSeeker	2190	23%
SCUMWARE_org	2190	23%
K7AntiVirus	1379	14%
Yandex Safebrowsing	1078	11%
ADMINUSLabs	961	10%
ParetoLogic	909	9%
ESET	767	8%
Google Safebrowsing	750	7%
C-SIRT	686	7%
Antiy-AVL	589	6%
Dr_Web	367	3%
CLEAN MX	253	2%
MalwareDomainList	139	1%
Kaspersky	109	1%
CyberCrime	73	0%
AlienVault	68	0%
Phishtank	66	0%
Comodo Site Inspector	66	0%
Sucuri SiteCheck	65	0%
Opera	64	0%
Netcraft	64	0%
Avira	17	0%
Malekal	4	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Cross-compiling cuckoomon under Linux

2013-05-23T20:44:00.002+02:00

Here is a quick tip on how to compile Cuckoomon under Linux for those who can't or do not want to install a development environment under Windows. Cuckoomon is the DLL (Dynamic-linked Library) that gets injected into the analysed malware sample to monitor the system calls the sample is performing. Unfortunately you will need a Windows environment with a compiler to perform any changes to the DLL. I have managed to cross-compile cuckoomon.dll under Ubuntu Linux by following this process:

Install MingGW

$ sudo apt-get install mingw32

Update Makefile and change

CC = gcc

CC = /usr/bin/i586-mingw32msvc-gcc

Compile the DLL:

$ make

And copy the resulting file (cuckoomon.dll) into ~/cuckoo/analyzer/windows/dll/cuckoomon.dll. You don't need to restart Cuckoo Sandbox for the changes to take effect as the file is copied to the guest at the beginning of each analyze task.

Upcoming article series: Cuckoo Sandbox on Hardware

2013-05-21T22:04:00.000+02:00

This is a bit of a heads-up and teaser post. In a series of articles I will disclose on how I perform malware analysis on on-the-iron hardware nodes with Cuckoo Sandbox. Some of the steps are optional, but if you want to achieve high sample throughput on hardware nodes then I highly suggest investing in the extra hardware which is not terrible expensive.

Here is the planned blog posts (and their expected publishing date):

Installing the clone management server (2013-06-03)
Installing the OS and required guest utils on the hardware node (2013-06-17)
Preparing the hardware node for cloning (2013-07-01)
Creating a golden image (2013-07-15)
Reverting to snapshot on hardware using software (2013-07-29)
Rebooting hardware node using software (2013-08-12)
Reverting to snapshot on hardware using hardware (2013-09-16)
Rebooting hardware node using hardware (2013-09-30)
Enabling hardware machine manager in Cuckoo Sandbox (2013-10-14)

The publishing schedule is based on the time I have available to spend on documenting this as well as not disclosing anything before the talk I submitted for 44Con. Your comments are much appreciated, do let me know your thoughts about this article series or malware analysis in general.

Weekly malware statistics between 2013-05-12 and 2013-05-19

2013-05-20T02:00:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 8882 samples was analyzed between 2013-05-12 and 2013-05-19.
409 samples was not deemed malicious by VirusTotal at the time of analysis.
2083 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
Fortinet	4493	70%
BitDefender	1640	25%
Sophos	1584	24%
Websense ThreatSeeker	1530	23%
SCUMWARE_org	1472	23%
K7AntiVirus	1006	15%
Yandex Safebrowsing	711	11%
ADMINUSLabs	638	9%
ParetoLogic	582	9%
ESET	563	8%
Google Safebrowsing	494	7%
C-SIRT	462	7%
Antiy-AVL	409	6%
MalwareDomainList	280	4%
Dr_Web	176	2%
CLEAN MX	114	1%
Phishtank	60	0%
Opera	56	0%
Netcraft	56	0%
Comodo Site Inspector	51	0%
AlienVault	51	0%
Sucuri SiteCheck	50	0%
Avira	44	0%
Kaspersky	31	0%
CyberCrime	22	0%
Quttera	9	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Running Cuckoo Web and API servers under Apache

2013-05-17T17:13:00.001+02:00

I have had reasons to run Cuckoo's web and API servers under Apache web server, part due to stability issues when running it stand-alone, but I also find it more nice when running things under Apache (one place to rule them all...).

Preparing web.py and api.py to run under Apache

Add the following files under ~cuckoo/utils:

cuckoo/utils/api.wsgi

# Copyright (c) 2013, Michael Boman
#
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ''AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
# EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

import os
import sys

cur_dir = os.path.dirname(__file__)

os.chdir(cur_dir)
sys.path.append(cur_dir)

import bottle
import api

application = bottle.default_app()

cuckoo/utils/web.wsgi

# Copyright (c) 2013, Michael Boman
#
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ''AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
# EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

import os
import sys

cur_dir = os.path.dirname(__file__)

os.chdir(cur_dir)
sys.path.append(cur_dir)

import bottle
import web

application = bottle.default_app()

Installing and preparing Apache

To run web.py and api.py under apache we need to have the WSGI (Web Service Gateway Interface) installed. To install Apache and the WSGI module run:

$ sudo apt-get install apache2 libapache2-mod-wsgi

Configuring Apache

You need to create two new site-definitions. Look at the examples below:

/etc/apache2/sites-available/cuckoo-api

    ServerAdmin michael@michaelboman.org
    ServerName mart-api.michaelboman.net

    WSGIDaemonProcess api user=mart group=mart processes=1 threads=5
    WSGIScriptAlias / /MART/cuckoo/utils/api.wsgi
    <directory api.wsgi="" cuckoo="" utils="">
        WSGIProcessGroup mart
        WSGIApplicationGroup %{GLOBAL}
        Order deny,allow
        Allow from all
    </directory>
    ErrorLog /MART/cuckoo/log/api-error.log
    LogLevel warn
    CustomLog /MART/cuckoo/log/api-access.log combined
    ServerSignature Off

/etc/apache2/sites-available/cuckoo-web

    ServerAdmin michael@michaelboman.org
    ServerName mart-web.michaelboman.net

    WSGIDaemonProcess web user=mart group=mart processes=1 threads=5
    WSGIScriptAlias / /MART/cuckoo/utils/web.wsgi
    <directory cuckoo="" utils="" web.wsgi="">
        WSGIProcessGroup mart
        WSGIApplicationGroup %{GLOBAL}
        Order deny,allow
        Allow from all
    </directory>
    ErrorLog /MART/cuckoo/log/web-error.log
    LogLevel warn
    CustomLog /MART/cuckoo/log/web-access.log combined
    ServerSignature Off

Enabling it

We need to enable the WSGI module and activate the two site definitions added above. You can do this by running:

$ sudo a2enmod wsgi
$ sudo a2ensite cuckoo-web
$ sudo a2ensite cuckoo-api

Future plans

Now when I have web.py and api.py running under Apache it should be fairly simple to SSL-enable the services. Stay tuned!

Weekly malware statistics between 2013-05-05 and 2013-05-12

2013-05-13T02:00:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 2119 samples was analyzed between 2013-05-05 and 2013-05-12.
103 samples was not deemed malicious by VirusTotal at the time of analysis.
307 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
Fortinet	982	57%
Sophos	448	26%
SCUMWARE_org	424	24%
Websense ThreatSeeker	346	20%
Yandex Safebrowsing	244	14%
K7AntiVirus	239	13%
ParetoLogic	172	10%
ADMINUSLabs	141	8%
Google Safebrowsing	133	7%
C-SIRT	131	7%
ESET	125	7%
BitDefender	61	3%
Dr_Web	36	2%
Sucuri SiteCheck	12	0%
Opera	12	0%
Netcraft	12	0%
AlienVault	12	0%
Phishtank	11	0%
Comodo Site Inspector	11	0%
Antiy-AVL	9	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Monitoring Cuckoo VMs from the console

2013-05-07T19:00:00.000+02:00

I have had some problems with hung VMs over the last few days. I think I have fixed it now, but meanwhile I am monitoring the status of my analysis machines with the script below. It takes the information from the API-server and renders it nicely in a ASCII table.

The script depends on the requests and texttable modules, but else it is pretty standard. You could replace requests with urllib, but as I already have requests available on my system and it is much nicer to work with I am using it.

Here is a screenshot of the script running under "watch".

And here is the code:

#!/usr/bin/env python

import requests
import json
import datetime
from texttable import Texttable

r = requests.get('http://localhost:8090/machines/list')
j = json.loads(r.content)

deltaTime = datetime.timedelta(minutes=10)
currentTime = datetime.datetime.now().replace(microsecond=0)

table = Texttable(max_width=0)
rows = list()

header = ["IP","Label","Locked","Lock change","Name","Platform","Status","Status change","Comment"]
rows.append(header)

for machine in j["machines"]:
    lastUpdated = datetime.datetime.strptime(machine["status_changed_on"], "%Y-%m-%d %H:%M:%S")
    if machine["locked"]:
        locked = "Yes"
    else:
        locked = "No"
    row = [
            machine["ip"],
            machine["label"],
            locked,
            machine["locked_changed_on"],
            machine["name"],
            machine["platform"],
            machine["status"],
            machine["status_changed_on"]
          ]
    if ((lastUpdated + deltaTime) < currentTime):
        row.append(str(currentTime - lastUpdated) + "\nHung???")
    else:
        row.append(currentTime - lastUpdated)
    rows.append(row)

table.add_rows(rows)
print table.draw()

Weekly malware statistics between 2013-04-28 and 2013-05-05

2013-05-06T09:26:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 586 samples was analyzed between 2013-04-28 and 2013-05-05.
25 samples was not deemed malicious by VirusTotal at the time of analysis.
225 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
Fortinet	186	55%
Sophos	88	26%
SCUMWARE_org	85	25%
Websense ThreatSeeker	78	23%
K7AntiVirus	50	14%
Yandex Safebrowsing	49	14%
ParetoLogic	32	9%
ADMINUSLabs	29	8%
Google Safebrowsing	28	8%
C-SIRT	27	8%
ESET	23	6%
Dr_Web	5	1%
BitDefender	4	1%
Sucuri SiteCheck	3	0%
Phishtank	3	0%
Comodo Site Inspector	3	0%
AlienVault	3	0%
Opera	1	0%
Netcraft	1	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Weekly malware statistics between 2013-04-21 and 2013-04-28

2013-04-29T02:00:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 5950 samples was analyzed between 2013-04-21 and 2013-04-28.
41 samples was not deemed malicious by VirusTotal at the time of analysis.
2736 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
Fortinet	2651	83%
GData	2503	78%
Ikarus	2497	78%
Comodo	2496	78%
Emsisoft	2477	78%
BitDefender	2469	77%
Sophos	2456	77%
AntiVir	2451	77%
McAfee-GW-Edition	2446	77%
McAfee	2435	76%
Avast	2428	76%
TrendMicro-HouseCall	2418	76%
NANO-Antivirus	2417	76%
F-Secure	2417	76%
Symantec	2403	75%
Kaspersky	2385	75%
PCTools	2296	72%
K7AntiVirus	2266	71%
nProtect	2259	71%
Agnitum	2251	70%
Panda	2230	70%
AVG	2219	69%
F-Prot	2211	69%
Commtouch	2199	69%
DrWeb	2183	68%
Microsoft	2177	68%
Norman	2172	68%
TrendMicro	2138	67%
MicroWorld-eScan	2087	65%
Jiangmin	2051	64%
VIPRE	1956	61%
ESET-NOD32	1948	61%
AhnLab-V3	1782	56%
eSafe	1665	52%
TheHacker	1658	52%
CAT-QuickHeal	1655	52%
TotalDefense	1566	49%
VBA32	1551	48%
Kingsoft	1476	46%
Antiy-AVL	1248	39%
ClamAV	1231	38%
ViRobot	1085	34%
Rising	1009	31%
SUPERAntiSpyware	682	21%
Malwarebytes	677	21%
SCUMWARE_org	132	4%
Websense ThreatSeeker	116	3%
ByteHero	90	2%
Yandex Safebrowsing	71	2%
K7GW	68	2%
ParetoLogic	59	1%
C-SIRT	50	1%
ADMINUSLabs	49	1%
ESET	42	1%
Google Safebrowsing	40	1%
Dr_Web	15	0%
Phishtank	4	0%
Opera	4	0%
Netcraft	4	0%
Comodo Site Inspector	4	0%
AlienVault	4	0%
VirusBuster	3	0%
Sucuri SiteCheck	3	0%
NOD32	3	0%
eTrust-Vet	1	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Talking about Malware Analysis at OWASP Stockholm 7th May

2013-04-24T20:55:00.000+02:00

I will be speaking on the topic of automated malware analysis at OWASP Sweden in Stockholm on the 7^th May between 18:00 - 21:00 at KTH (Kungliga Tekniska Högskolan, Royal Institute of Technology). The talk will build upon my earlier presentations at 44Con, OWASP Sweden (in Gothenburg) and DEEPSEC but contain updated materials as well as more war stories...

Register at EventBrite for your ticket - but hurry, they are going fast...

Hacker Hotshot: Malware Analysis on a Shoe String Budget

2013-04-24T20:34:00.001+02:00

Here is the recording of my presentation "Malware Analysis on a Shoe-String Budget" that I performed earlier today at Hacker Hotshot. If you have any questions do leave a comment and I'll get back to you.

Next up on my presentation schedule is OWASP Sweden in Stockholm on the same topic.

Weekly malware statistics between 2013-04-14 and 2013-04-21

2013-04-22T02:00:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 2695 samples was analyzed between 2013-04-14 and 2013-04-21.
3 samples was not deemed malicious by VirusTotal at the time of analysis.
1290 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
GData	1354	96%
Comodo	1348	96%
Ikarus	1347	96%
AntiVir	1346	96%
Emsisoft	1332	95%
BitDefender	1330	94%
Avast	1325	94%
F-Secure	1315	93%
McAfee	1304	93%
NANO-Antivirus	1302	92%
Kaspersky	1302	92%
McAfee-GW-Edition	1297	92%
TrendMicro-HouseCall	1294	92%
Fortinet	1286	91%
Symantec	1264	90%
Sophos	1257	89%
nProtect	1227	87%
PCTools	1213	86%
F-Prot	1186	84%
Microsoft	1184	84%
Commtouch	1179	84%
Panda	1178	84%
Agnitum	1174	83%
AVG	1170	83%
Norman	1158	82%
DrWeb	1151	82%
K7AntiVirus	1136	81%
TrendMicro	1126	80%
Jiangmin	1109	79%
MicroWorld-eScan	1082	77%
VIPRE	1003	71%
ESET-NOD32	995	70%
AhnLab-V3	932	66%
CAT-QuickHeal	870	62%
TheHacker	869	61%
eSafe	855	60%
TotalDefense	847	60%
VBA32	830	59%
Kingsoft	746	53%
ClamAV	707	50%
Antiy-AVL	685	48%
Rising	634	45%
ViRobot	541	38%
Malwarebytes	319	22%
SUPERAntiSpyware	315	22%
ByteHero	58	4%
VirusBuster	2	0%
NOD32	2	0%
eTrust-Vet	1	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Presenting Malware Analysis on a shoe-string budget @ Hacker Hotshots

2013-04-16T12:31:00.000+02:00

I will speak about "Malware Analysis on a Shoe-string Budget" at "Hacker Hotshots" on the 24:th April at 9am Pacific, 12pm Eastern.

Translated into GMT it will be 4pm (16:00), or 6pm (18:00) Swedish local time - if I did my calculations correctly (If not, please leave a comment so I can update the post).

EDIT: 7pm Swedish local time according to timeanddate.com. Thanks to +Fredrik Karlsson for the correction.

From the presentation description:

Michael Is Going To Show You...

How To Conduct Malware Analysis On A Shoestring Budget

How To Processing 10k Malware Samples A Week!

How To Replicate Michael's Malware Analysis Lab

Malware analysis used to be difficult and time-consuming, and the systems available required a lot of manual labour and/or was too expensive for hobbyists. I am a father of five wonderful kids, aged between 15 years and 10 months old. I also work a 40 hour/week and have a 3 hour/day commute to and from work every day. I also don't have ton of money to spend on my weird hobby. Between my job responsibilities, my responsibilities as a father and husband I don't have much time doing malware analysis - yet I am processing almost 10 thousand malware samples a week, or one every minute, every hour of every day of the week. The secret is to automate yourself out of the process, and I will explain how I did it and how you can replicate my malware analysis lab and how to get started with malware analysis.

I hope that you have time to come and watch me live, but if not the session will be recorded.

Weekly malware statistics between 2013-03-31 and 2013-04-07

2013-04-08T02:06:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 9745 samples was analyzed between 2013-03-31 and 2013-04-07.
436 samples was not deemed malicious by VirusTotal at the time of analysis.
2945 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
Comodo	5490	86%
Ikarus	5484	86%
GData	5468	85%
AntiVir	5371	84%
BitDefender	5357	84%
Fortinet	5354	84%
McAfee-GW-Edition	5344	83%
Avast	5317	83%
TrendMicro-HouseCall	5315	83%
Emsisoft	5305	83%
McAfee	5296	83%
F-Secure	5295	83%
Kaspersky	5268	82%
Symantec	5212	81%
NANO-Antivirus	5128	80%
Sophos	4897	76%
DrWeb	4882	76%
PCTools	4857	76%
AVG	4825	75%
K7AntiVirus	4754	74%
Norman	4753	74%
nProtect	4739	74%
F-Prot	4712	74%
Agnitum	4657	73%
Commtouch	4610	72%
Panda	4609	72%
TrendMicro	4584	72%
Microsoft	4535	71%
ESET-NOD32	4494	70%
Jiangmin	4418	69%
VIPRE	4413	69%
MicroWorld-eScan	4156	65%
AhnLab-V3	3961	62%
CAT-QuickHeal	3640	57%
VBA32	3518	55%
Kingsoft	3457	54%
TheHacker	3344	52%
TotalDefense	3336	52%
eSafe	3327	52%
Antiy-AVL	2520	39%
Rising	2411	37%
ClamAV	2394	37%
ViRobot	2306	36%
Malwarebytes	1853	29%
SUPERAntiSpyware	1453	22%
SCUMWARE_org	212	3%
ADMINUSLabs	198	3%
Yandex Safebrowsing	196	3%
ByteHero	192	3%
Websense ThreatSeeker	176	2%
Google Safebrowsing	133	2%
ParetoLogic	45	0%
ESET	36	0%
Dr_Web	17	0%
Sucuri SiteCheck	14	0%
AlienVault	13	0%
Avira	11	0%
Comodo Site Inspector	10	0%
SecureBrain	7	0%
Phishtank	6	0%
Netcraft	5	0%
VirusBuster	4	0%
Opera	4	0%
NOD32	4	0%
Malc0de Database	4	0%
eTrust-Vet	3	0%
G-Data	1	0%
C-SIRT	1	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

RemoveClone.py

2013-04-04T07:47:00.000+02:00

Last Tuesday I blogged about the python version of CloneAndAdd which creates a VirtualBox linked clone and adds it to Cuckoo Sandbox. Here is the other part of the functionality named "RemoveClone.py", which deletes a VirtualBox clone and remove it from the Cuckoo Sandbox configuration files.

Command usage:

usage: RemoveClone.py [-h] CLONE [CLONE ...]

Removes a clone

positional arguments:
  CLONE       list of clones to remove

optional arguments:
  -h, --help  show this help message and exit

You run it like this to remove the clone we created in the last post (cuckoo2):

$ ./RemoveClone.py cuckoo2

Code listing:

#!/usr/bin/env python

import sys
import os
import re
import time
import random
import subprocess
import argparse
import ConfigParser

from pprint import pprint
import code

sys.path.append(os.path.join(os.path.abspath(os.path.dirname(__file__)), ".."))
from lib.cuckoo.common.constants import CUCKOO_ROOT

Config = ConfigParser.ConfigParser()

def ConfigSectionMap(section):
    dict1 = {}
    options = Config.options(section)
    for option in options:
        try:
            dict1[option] = Config.get(section, option)
            if dict1[option] == -1:
                DebugPrint("skip: %s" % option)
        except:
            print("exception on %s!" % option)
            dict1[option] = None
    return dict1

def runcmd(cmd):
    print "Executing %s" % ' '.join(cmd)
    return(subprocess.check_output(cmd))

def RemoveClone(target):
    # Init
    vbox_conf = os.path.join(CUCKOO_ROOT,"conf","virtualbox.conf")
    Config.read(vbox_conf)
    VBoxManage = ConfigSectionMap("virtualbox")["path"]
    
    # Turn off the virtual machine
    try:
        runcmd([VBoxManage,"controlvm",target,"poweroff"])
    except:
        print "Can't power off machine. Already turned off?"

    # Delete the virtual machine
    runcmd([VBoxManage,"unregistervm",target,"--delete"])

    # Remove host definition
    if target in Config.sections():
        Config.remove_section(target)

    # Add the machine to the list of active machines
    vms = ConfigSectionMap("virtualbox")["machines"].split(",") # Create a list of already configured VMS
    vms = sorted(set(vms))
    vms.remove(target) # Remove the machine
    Config.set("virtualbox","machines",','.join(sorted(set(vms)))) # Make sure that each machine is only defined once

    # Save the configuration file
    cfgfile = open(vbox_conf,'w')
    Config.write(cfgfile)
    cfgfile.close()

    # Done

if  __name__ =='__main__':
    parser = argparse.ArgumentParser(description='Removes a clone')

    parser.add_argument('targets', metavar='CLONE', type=str, nargs='+',help='list of clones to remove')

    args = parser.parse_args()

    for target in args.targets:
        RemoveClone(target)

I hope that this is of use for you, and please leave any feedback in the comment section.

Clone and Add, python version

2013-04-02T22:39:00.000+02:00

I have re-written my old CloneAndAdd script, which creates clones to be using with Cuckoo, in python and at the same time added some command line options.

I still depend on compname.exe from http://www.willowhayes.co.uk/ for renaming the clone, and now I also depend on "pskill.exe" from SysInternals to kill the python process as I am updating agent.py to the latest version when cloning.

I have put agent.py in my autostart folder so it will execute at bootup every time the system starts. This is the command usage:

usage: CloneAndAdd.py [-h] [--template TEMPLATE] [--snapshot SNAPSHOT]
                      [--platform PLATFORM] [--username USERNAME]
                      [--password PASSWORD]
                      CLONE [CLONE ...]

Create a new clone and add it to the list of available machines

positional arguments:
  CLONE                list of clones to create

optional arguments:
  -h, --help           show this help message and exit
  --template TEMPLATE  Template to clone
  --snapshot SNAPSHOT  Snapshot to clone
  --platform PLATFORM  Guest OS
  --username USERNAME  Username of the VM guest user
  --password PASSWORD  Password of the VM guest user's password

To create a new linked clone from "cuckoo1" with the snapshot of "current" to "cuckoo2" you run it like this:

$ CloneAndAdd.py --template cuckoo1 --snapshot current --platform windows --username cuckoo --password cuckoo cuckoo2

#!/usr/bin/env python

import sys
import os
import re
import time
import random
import subprocess
import argparse
import ConfigParser

from pprint import pprint
import code

sys.path.append(os.path.join(os.path.abspath(os.path.dirname(__file__)), ".."))
from lib.cuckoo.common.constants import CUCKOO_ROOT

Config = ConfigParser.ConfigParser()

def randomMAC():
    mac = [ 0x00, 0x16, 0x3e,
        random.randint(0x00, 0x7f),
        random.randint(0x00, 0xff),
        random.randint(0x00, 0xff) ]
    return ''.join(map(lambda x: "%02x" % x, mac))

def getnewmac(hostname):
    regex = r"(%s)\s+([0-9A-Fa-f]+)\s+([0-9\.]+)" % hostname
    pat = re.compile(regex, re.I | re.S | re.M)

    with open("/MART/etc/macs.txt") as fh:
        for line in fh:
            if pat.search(line):
                (hostname,mac,ip) = pat.match(line).groups()
                if mac:
                    return mac

    return randomMAC()

def ConfigSectionMap(section):
    dict1 = {}
    options = Config.options(section)
    for option in options:
        try:
            dict1[option] = Config.get(section, option)
            if dict1[option] == -1:
                DebugPrint("skip: %s" % option)
        except:
            print("exception on %s!" % option)
            dict1[option] = None
    return dict1

def runcmd(cmd):
    print "Executing %s" % ' '.join(cmd)
    return(subprocess.check_output(cmd))


def CloneAndAdd(template,snapshot,platform,target,username,password):
    # Init
    vbox_conf = os.path.join(CUCKOO_ROOT,"conf","virtualbox.conf")
    Config.read(vbox_conf)
    VBoxManage = ConfigSectionMap("virtualbox")["path"]

    # Clone the virtual machine
    runcmd([VBoxManage,"clonevm",template,"--name",target,"--snapshot",snapshot,"--options","link","--register"])

    # Setting guest MAC
    newmac = getnewmac(target)
    runcmd([VBoxManage,"modifyvm",target,"--macaddress1",newmac])

    # Enable memory ballooning
    runcmd([VBoxManage,"modifyvm",target,"--pagefusion","on"])

    # Start up virtual machine
    runcmd([VBoxManage,"startvm",target,"--type",ConfigSectionMap("virtualbox")["mode"]])

    # Wait until the virtual machine has booted up
    time.sleep(2*60) # FIXME: Need to find a better way to do this...

    # Copy the latest Cuckoo Agent to the system
    runcmd([VBoxManage,"guestcontrol",target,"execute","--image","c:/Sysinternals/pskill.exe","--username",username,"--password",password,"--verbose","--wait-exit","--wait-stdout","--wait-stderr","--","/ACCEPTEULA","pythonw"])
    runcmd([VBoxManage,"guestcontrol",target,"copyto","--username",username,"--password",password,os.path.join(CUCKOO_ROOT,"agent","agent.py"),"C:/Agent/Agent.pyw"])

    # Rename the virtual machine guest OS
    runcmd([VBoxManage,"guestcontrol",target,"execute","--username",username,"--password",password,"--image","C:/compname.exe","--wait-exit","--","/c",target])

    # Reboot the virtual machine
    runcmd([VBoxManage,"guestcontrol",target,"execute","--username",username,"--password",password,"--image","C:/WINDOWS/system32/shutdown.exe","--","-r","-f","-t","0"])

    # Wait until the virtual machine has booted up
    time.sleep(2*60) # FIXME: Need to find a better way to do this....

    # Getting guest IP
    guestip = runcmd([VBoxManage,"guestproperty","get",target,"/VirtualBox/GuestInfo/Net/0/V4/IP"]).split(" ")[1]

    # Create snapshot
    runcmd([VBoxManage,"snapshot",target,"take","Initial snapshot from template","--pause"])
    runcmd([VBoxManage,"controlvm",target,"poweroff"])

    # Add host definition
    if not target in Config.sections():
        Config.add_section(target)
    Config.set(target,"label",target)
    Config.set(target,"platform",platform)
    Config.set(target,"ip",guestip)

    # Add the machine to the list of active machines
    vms = ConfigSectionMap("virtualbox")["machines"].split(",") # Create a list of already configured VMS
    vms.append(target) # Append the new machine
    Config.set("virtualbox","machines",','.join(sorted(set(vms)))) # Make sure that each machine is only defined once

    # Save the configuration file
    cfgfile = open(vbox_conf,'w')
    Config.write(cfgfile)
    cfgfile.close()

    # Done

if  __name__ =='__main__':
    parser = argparse.ArgumentParser(description='Create a new clone and add it to the list of available machines')

    parser.add_argument('targets', metavar='CLONE', type=str, nargs='+',help='list of clones to create')
    parser.add_argument('--template', dest='template', default='MART-XP-Template', help='Template to clone')
    parser.add_argument('--snapshot', dest='snapshot', default='current', help='Snapshot to clone')
    parser.add_argument('--platform', dest='platform', default='windows', help='Guest OS')
    parser.add_argument('--username', dest='username', default='mart', help='Username of the VM guest user')
    parser.add_argument('--password', dest='password', default='mart', help='Password of the VM guest user\'s password')

    args = parser.parse_args()

    for target in args.targets:
        CloneAndAdd(args.template,args.snapshot,args.platform,target,args.username,args.password)

I hope to evolve this to a VM-agnostic program where any (Cuckoo supported) VM-technology can be utilised to create (and remove) guest machines, and in time become a standard Cuckoo Sandbox component.

Weekly malware statistics between 2013-03-24 and 2013-03-31

2013-04-01T02:05:00.001+02:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 92 samples was analyzed between 2013-03-24 and 2013-03-31.
1 samples was not deemed malicious by VirusTotal at the time of analysis.
5 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
Fortinet	54	62%
Sophos	37	43%
SCUMWARE_org	35	40%
Websense ThreatSeeker	27	31%
BitDefender	14	16%
nProtect	13	15%
Yandex Safebrowsing	13	15%
TrendMicro-HouseCall	13	15%
TrendMicro	13	15%
Symantec	13	15%
Panda	13	15%
PCTools	13	15%
Norman	13	15%
Kaspersky	13	15%
K7AntiVirus	13	15%
Ikarus	13	15%
GData	13	15%
F-Secure	13	15%
Emsisoft	13	15%
DrWeb	13	15%
Comodo	13	15%
ClamAV	13	15%
CAT-QuickHeal	13	15%
Avast	13	15%
AntiVir	13	15%
ViRobot	12	13%
VIPRE	12	13%
Jiangmin	12	13%
VBA32	11	12%
TheHacker	11	12%
McAfee-GW-Edition	11	12%
McAfee	11	12%
Google Safebrowsing	11	12%
Commtouch	11	12%
AVG	11	12%
Microsoft	10	11%
F-Prot	10	11%
ESET	10	11%
Antiy-AVL	10	11%
AhnLab-V3	10	11%
Rising	9	10%
eSafe	8	9%
TotalDefense	8	9%
SUPERAntiSpyware	8	9%
ParetoLogic	8	9%
ESET-NOD32	7	8%
NOD32	6	6%
AlienVault	6	6%
Kingsoft	5	5%
eTrust-Vet	4	4%
MicroWorld-eScan	4	4%
Agnitum	4	4%
ADMINUSLabs	4	4%
Opera	3	3%
Netcraft	3	3%
VirusBuster	2	2%
Sucuri SiteCheck	2	2%
Phishtank	2	2%
Dr_Web	2	2%
ByteHero	2	2%
NANO-Antivirus	1	1%
Malwarebytes	1	1%
Comodo Site Inspector	1	1%
Avira	1	1%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Weekly malware statistics between 2013-03-10 and 2013-03-17

2013-03-18T02:01:00.001+01:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 0 samples was analyzed between 2013-03-10 and 2013-03-17.
0 samples was not deemed malicious by VirusTotal at the time of analysis.
0 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Call for Papers submissions

2013-03-12T21:47:00.000+01:00

I have submitted a few presentations to the conferences I spoke at last year, which I hope will be accepted. The presentation offers has been made exclusively to each conference, and will be performed there first if accepted.

44Con 2013

Malware analysis on non-virtual environments

Malware analysis are today mostly done in virtual machines as they are cheaper and easier to manage compared to hardware boxes. Unfortunately malware developers knows this and are applying a lot of tricks to make it hard for a malware analyst to reverse engineer the samples. I have developed a way to manage standard desktop PCs to be using in malware analysis using open source software and some cheap off-the-shelf hardware.

DEEPSEC 2013

Malware datamining and attribution

Greg Hoglund explained at BlackHat 2010 that the development environments that malware authors use leaves traces in the code which can be used to attribute malware to a a individual or a group of individuals. Not with the precision of name, date of birth and address but with evidence that a arrested suspects computer can be analysed and compared with the "tool marks" on the collected malware samples. This talk will present the results of the analysis on malware collected by the MART Project as well as the tools created to perform the analysis. The tools will be released at the conference.

I will keep you guys updated if the talks gets accepted (or rejected) and any other conferences I submit to in the same format as above.

Weekly malware statistics between 2013-03-03 and 2013-03-10

2013-03-11T02:02:00.001+01:00

This is a report of malware detected by VirusTotal at the time of sample analysis.
The underlying method of analysis is pretty flawed so the information provided should not be used for anything important.

A total of 1285 samples was analyzed between 2013-03-03 and 2013-03-10.
40 samples was not deemed malicious by VirusTotal at the time of analysis.
739 samples was not scanned by VirusTotal before at the time of analysis.

Engine	Detected samples	Detection raito
McAfee-GW-Edition	391	77%
Malwarebytes	387	76%
AntiVir	372	73%
Fortinet	359	70%
ESET-NOD32	354	69%
PCTools	349	68%
GData	344	67%
BitDefender	335	66%
Ikarus	314	62%
VIPRE	307	60%
F-Secure	306	60%
Kaspersky	299	59%
McAfee	298	58%
DrWeb	271	53%
CAT-QuickHeal	263	51%
MicroWorld-eScan	260	51%
Comodo	249	49%
Symantec	246	48%
Avast	239	47%
AhnLab-V3	239	47%
Emsisoft	232	45%
TrendMicro-HouseCall	227	44%
AVG	226	44%
F-Prot	219	43%
K7AntiVirus	218	43%
Jiangmin	210	41%
NANO-Antivirus	206	40%
Rising	202	39%
TotalDefense	195	38%
Kingsoft	191	37%
Panda	189	37%
Norman	184	36%
VBA32	175	34%
TrendMicro	165	32%
nProtect	155	30%
Agnitum	128	25%
Commtouch	127	25%
Microsoft	120	23%
SUPERAntiSpyware	104	20%
Sophos	95	18%
ClamAV	58	11%
eSafe	44	8%
TheHacker	41	8%
Antiy-AVL	35	6%
ViRobot	14	2%
ByteHero	3	0%

- Mallory Rasputin, overworked and underpaid malware research intern. You can reach me at research@michaelboman.org.

Michael Boman

Cuckoo Sandbox on Hardware: Installing the OS and required guest utils on the hardware node

Installing the OS

Turning off UAC (User Account Control)

Installing FOG guest utils

Installing Cuckoo Sandbox Agent

Installing Python and PIL (Python Image Library)

Installing the Cuckoo Sandbox Agent

Make the Cuckoo user logon automatically

Weekly malware statistics between 2013-06-09 and 2013-06-16

File Analysis

URL Analysis

Weekly malware statistics between 2013-06-02 and 2013-06-09

File Analysis

URL Analysis

Weekly malware statistics between 2013-05-26 and 2013-06-02

File Analysis

URL Analysis

Cuckoo Sandbox on Hardware: Installing the clone management server

Installing FOG Project server in a OpenVZ container

Creating a Ubuntu OpenVZ container

Enabling networking

Once you have the system running and some network connectivity it is a good time to make sure the system is up-to-date. The process is like any other Debian/Ubuntu based system: # apt-get update# apt-get dist-upgrade Downloading FOG Server

Installing user-space NFS-server

Downloading

Packaging

Installing

Installing FOG Project

Conclusions

Weekly malware statistics between 2013-05-19 and 2013-05-26

Cross-compiling cuckoomon under Linux

Upcoming article series: Cuckoo Sandbox on Hardware

Weekly malware statistics between 2013-05-12 and 2013-05-19

Running Cuckoo Web and API servers under Apache

Preparing web.py and api.py to run under Apache

cuckoo/utils/api.wsgi

cuckoo/utils/web.wsgi

Installing and preparing Apache

Configuring Apache

/etc/apache2/sites-available/cuckoo-api

/etc/apache2/sites-available/cuckoo-web

Enabling it

Future plans

Weekly malware statistics between 2013-05-05 and 2013-05-12

Monitoring Cuckoo VMs from the console

Weekly malware statistics between 2013-04-28 and 2013-05-05

Weekly malware statistics between 2013-04-21 and 2013-04-28

Talking about Malware Analysis at OWASP Stockholm 7th May

Hacker Hotshot: Malware Analysis on a Shoe String Budget

Weekly malware statistics between 2013-04-14 and 2013-04-21

Presenting Malware Analysis on a shoe-string budget @ Hacker Hotshots

Weekly malware statistics between 2013-03-31 and 2013-04-07

RemoveClone.py

Clone and Add, python version

Weekly malware statistics between 2013-03-24 and 2013-03-31

Weekly malware statistics between 2013-03-10 and 2013-03-17

Call for Papers submissions

44Con 2013

Malware analysis on non-virtual environments

DEEPSEC 2013

Malware datamining and attribution

Weekly malware statistics between 2013-03-03 and 2013-03-10

Once you have the system running and some network connectivity it is a good time to make sure the system is up-to-date. The process is like any other Debian/Ubuntu based system:

# apt-get update# apt-get dist-upgrade
Downloading FOG Server