ToolWar | Information Security (InfoSec) Tools: Sandbox

<div class="row" style="text-align: justify;">
<div class="span6" style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="Cockoo sandbox logo" border="0" height="128" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgibr626QwfgXHYV4JYq_X59SkjRlgqtUxt37xeoKA02je4VxQCzLHM2HF_UMNOs73aOU78-Ym3kDdcNf_Sh4lu8veicfMPHF_ExBSG4ZSq32iari06OXQx68KZJGay6AFbiMYSwZObGuUD/s400/cuckoo+sandbox+logo.png" title="Cockoo sandbox logo" width="400" /></div>
<h3>
What is Cuckoo Sandbox?</h3>
<b>Cuckoo Sandbox</b> is a <b><i>malware analysis system</i></b>. What does that mean? It simply means that you can  throw any <i>suspicious file</i> at it and in a matter of seconds Cuckoo will  provide you back some detailed results outlining what such file did when  executed inside an isolated environment.<br />
<h3>
Why should you use it?</h3>
<i><b>Malware</b> is the swiss-army knife of cybercriminals</i> and any other adversary to your corporation or organization.<br />
In these evolving times, detecting and removing <a href="http://www.toolwar.com/search/label/Malware" target="_blank"> malware</a> artifacts is not enough: it's vitally important to understand  how they work and what they would do/did on your systems when deployed  and understand the context, the motivations and the goals of a breach.<br />
In this way you are able to more effectively understand the incident, respond to it and protect yourself for the future.<br />
There are infinite other contexts where you might  need to deploy a sandbox internally, from <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyzing</a> an internal breach  to proactively scouting wildly distributed threats, collect actionable  data and analyzing the ones actively targeting your infrastructure or  products.<br />
In any of these cases you'll find Cuckoo to be perfectly suitable, incredibly customizable and well... free!</div>
<div class="span6" style="text-align: justify;">
<h3>
What does it produce?</h3>
Cuckoo generates a handful of different raw data which include:<br />
<ul>
<li>Native functions and <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> API calls traces</li>
<li>Copies of files created and deleted from the filesystem</li>
<li>Dump of the memory of the selected process</li>
<li>Full <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> dump of the analysis machine</li>
<li>Screenshots of the desktop during the execution of the malware analysis</li>
<li><a href="http://www.toolwar.com/search/label/Network" target="_blank">Network</a> dump generated by the machine used for the analysis</li>
</ul>
In order to make such results more consumable to the  end users, Cuckoo is able to process them and generate different type of  reports, which could include:<br />
<ul>
<li>JSON report</li>
<li>HTML report</li>
<li>MAEC report</li>
<li>MongoDB interface</li>
<li>HPFeeds interface</li>
</ul>
Even more interestingly, thanks to Cuckoo's extensive  modular design, you are able to customize both the processing and the  reporting stages. Cuckoo provides you all the requirements to easily  integrate the sandbox into your existing <a href="http://www.toolwar.com/search/label/Framework" target="_blank">frameworks</a> and storages with  the data you want, in the way you want, with the format you want.<br />
<h3>
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/720Vh3FaGN8?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/KVoDCrYeCXo?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/-npWBiDloRQ?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download :: </h3>
<b>Alternative Downloads ::</b><br />
<pre>git clone git://github.com/cuckoobox/cuckoo.git</pre>
If you want to clone a specific branch ::<br />
<pre>git clone -b <branch name> git://github.com/cuckoobox/cuckoo.git</pre>
<b><span style="font-family: inherit;">Linux ::</span></b> <a href="http://www.cuckoosandbox.org/download.html" target="_blank">Cuckoo Sandbox 0.6</a><br />
<b>Official Website :: </b>http://www.cuckoosandbox.org/<br />
<h3>
</h3>
</div>
</div>

Cuckoo Sandbox (Malware Analysis) :: Tools

What is Cuckoo Sandbox? Cuckoo Sandbox is a malware analysis system . What does that mean? It simply means that you can throw any su...