cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.53k stars 1.7k forks source link

Failure in AnalysisManager.run #1876

Closed ramirez3805 closed 6 years ago

ramirez3805 commented 6 years ago

Hi guys, running into an issue with my new setup. Running 2.0.4 doing an analysis against a Ubuntu 16 guest and host. This is what I am getting.

2017-10-02 17:03:59,658 [cuckoo.core.startup] DEBUG: Imported "auxiliary" modules:
2017-10-02 17:03:59,658 [cuckoo.core.startup] DEBUG:     |-- MITM
2017-10-02 17:03:59,658 [cuckoo.core.startup] DEBUG:     |-- Reboot
2017-10-02 17:03:59,658 [cuckoo.core.startup] DEBUG:     |-- Services
2017-10-02 17:03:59,659 [cuckoo.core.startup] DEBUG:     `-- Sniffer
2017-10-02 17:03:59,659 [cuckoo.core.startup] DEBUG: Imported "machinery" modules:
2017-10-02 17:03:59,659 [cuckoo.core.startup] DEBUG:     |-- vSphere
2017-10-02 17:03:59,659 [cuckoo.core.startup] DEBUG:     |-- KVM
2017-10-02 17:03:59,659 [cuckoo.core.startup] DEBUG:     |-- ESX
2017-10-02 17:03:59,659 [cuckoo.core.startup] DEBUG:     |-- XenServer
2017-10-02 17:03:59,659 [cuckoo.core.startup] DEBUG:     |-- VMware
2017-10-02 17:03:59,659 [cuckoo.core.startup] DEBUG:     |-- Avd
2017-10-02 17:03:59,660 [cuckoo.core.startup] DEBUG:     |-- QEMU
2017-10-02 17:03:59,660 [cuckoo.core.startup] DEBUG:     |-- VirtualBox
2017-10-02 17:03:59,660 [cuckoo.core.startup] DEBUG:     `-- Physical
2017-10-02 17:03:59,660 [cuckoo.core.startup] DEBUG: Imported "processing" modules:
2017-10-02 17:03:59,660 [cuckoo.core.startup] DEBUG:     |-- AnalysisInfo
2017-10-02 17:03:59,660 [cuckoo.core.startup] DEBUG:     |-- ApkInfo
2017-10-02 17:03:59,660 [cuckoo.core.startup] DEBUG:     |-- Baseline
2017-10-02 17:03:59,661 [cuckoo.core.startup] DEBUG:     |-- BehaviorAnalysis
2017-10-02 17:03:59,661 [cuckoo.core.startup] DEBUG:     |-- Debug
2017-10-02 17:03:59,661 [cuckoo.core.startup] DEBUG:     |-- Droidmon
2017-10-02 17:03:59,661 [cuckoo.core.startup] DEBUG:     |-- Dropped
2017-10-02 17:03:59,661 [cuckoo.core.startup] DEBUG:     |-- DroppedBuffer
2017-10-02 17:03:59,661 [cuckoo.core.startup] DEBUG:     |-- Extracted
2017-10-02 17:03:59,661 [cuckoo.core.startup] DEBUG:     |-- GooglePlay
2017-10-02 17:03:59,662 [cuckoo.core.startup] DEBUG:     |-- Irma
2017-10-02 17:03:59,662 [cuckoo.core.startup] DEBUG:     |-- Memory
2017-10-02 17:03:59,662 [cuckoo.core.startup] DEBUG:     |-- MetaInfo
2017-10-02 17:03:59,662 [cuckoo.core.startup] DEBUG:     |-- MISP
2017-10-02 17:03:59,662 [cuckoo.core.startup] DEBUG:     |-- NetworkAnalysis
2017-10-02 17:03:59,662 [cuckoo.core.startup] DEBUG:     |-- ProcessMemory
2017-10-02 17:03:59,662 [cuckoo.core.startup] DEBUG:     |-- Procmon
2017-10-02 17:03:59,663 [cuckoo.core.startup] DEBUG:     |-- Screenshots
2017-10-02 17:03:59,663 [cuckoo.core.startup] DEBUG:     |-- Snort
2017-10-02 17:03:59,663 [cuckoo.core.startup] DEBUG:     |-- Static
2017-10-02 17:03:59,663 [cuckoo.core.startup] DEBUG:     |-- Strings
2017-10-02 17:03:59,663 [cuckoo.core.startup] DEBUG:     |-- Suricata
2017-10-02 17:03:59,663 [cuckoo.core.startup] DEBUG:     |-- TargetInfo
2017-10-02 17:03:59,664 [cuckoo.core.startup] DEBUG:     |-- TLSMasterSecrets
2017-10-02 17:03:59,664 [cuckoo.core.startup] DEBUG:     `-- VirusTotal
2017-10-02 17:03:59,664 [cuckoo.core.startup] DEBUG: Imported "signatures" modules:
2017-10-02 17:03:59,664 [cuckoo.core.startup] DEBUG:     |-- AndroidAbortBroadcast
2017-10-02 17:03:59,664 [cuckoo.core.startup] DEBUG:     |-- AndroidAccountInfo
2017-10-02 17:03:59,664 [cuckoo.core.startup] DEBUG:     |-- AndroidAppInfo
2017-10-02 17:03:59,664 [cuckoo.core.startup] DEBUG:     |-- AndroidAudio
2017-10-02 17:03:59,665 [cuckoo.core.startup] DEBUG:     |-- AndroidCamera
2017-10-02 17:03:59,665 [cuckoo.core.startup] DEBUG:     |-- AndroidDangerousPermissions
2017-10-02 17:03:59,665 [cuckoo.core.startup] DEBUG:     |-- AndroidDeletedApp
2017-10-02 17:03:59,665 [cuckoo.core.startup] DEBUG:     |-- AndroidDynamicCode
2017-10-02 17:03:59,665 [cuckoo.core.startup] DEBUG:     |-- AndroidEmbeddedApk
2017-10-02 17:03:59,665 [cuckoo.core.startup] DEBUG:     |-- AndroidGooglePlayDiff
2017-10-02 17:03:59,666 [cuckoo.core.startup] DEBUG:     |-- AndroidInstalledApps
2017-10-02 17:03:59,666 [cuckoo.core.startup] DEBUG:     |-- AndroidNativeCode
2017-10-02 17:03:59,666 [cuckoo.core.startup] DEBUG:     |-- AndroidPhoneNumber
2017-10-02 17:03:59,666 [cuckoo.core.startup] DEBUG:     |-- AndroidPrivateInfoQuery
2017-10-02 17:03:59,666 [cuckoo.core.startup] DEBUG:     |-- AndroidReflectionCode
2017-10-02 17:03:59,666 [cuckoo.core.startup] DEBUG:     |-- AndroidRegisteredReceiver
2017-10-02 17:03:59,667 [cuckoo.core.startup] DEBUG:     |-- AndroidShellCommands
2017-10-02 17:03:59,667 [cuckoo.core.startup] DEBUG:     |-- AndroidSMS
2017-10-02 17:03:59,667 [cuckoo.core.startup] DEBUG:     |-- AndroidStopProcess
2017-10-02 17:03:59,667 [cuckoo.core.startup] DEBUG:     |-- ApplicationUsesLocation
2017-10-02 17:03:59,667 [cuckoo.core.startup] DEBUG:     |-- KnownVirustotal
2017-10-02 17:03:59,667 [cuckoo.core.startup] DEBUG:     |-- AntiAnalysisJavascript
2017-10-02 17:03:59,668 [cuckoo.core.startup] DEBUG:     |-- DumpedBuffer
2017-10-02 17:03:59,668 [cuckoo.core.startup] DEBUG:     |-- DumpedBuffer2
2017-10-02 17:03:59,668 [cuckoo.core.startup] DEBUG:     |-- EncryptionKeys
2017-10-02 17:03:59,668 [cuckoo.core.startup] DEBUG:     |-- EvalJS
2017-10-02 17:03:59,668 [cuckoo.core.startup] DEBUG:     |-- Exploit_zteF460F660
2017-10-02 17:03:59,668 [cuckoo.core.startup] DEBUG:     |-- HtmlFlash
2017-10-02 17:03:59,669 [cuckoo.core.startup] DEBUG:     |-- JsIframe
2017-10-02 17:03:59,669 [cuckoo.core.startup] DEBUG:     |-- PDFAttachments
2017-10-02 17:03:59,669 [cuckoo.core.startup] DEBUG:     |-- PDFJavaScript
2017-10-02 17:03:59,669 [cuckoo.core.startup] DEBUG:     |-- PDFOpenAction
2017-10-02 17:03:59,670 [cuckoo.core.startup] DEBUG:     |-- PDFOpenActionJS
2017-10-02 17:03:59,670 [cuckoo.core.startup] DEBUG:     |-- SuspiciousJavascript
2017-10-02 17:03:59,670 [cuckoo.core.startup] DEBUG:     |-- DarwinCodeInjection
2017-10-02 17:03:59,670 [cuckoo.core.startup] DEBUG:     |-- TaskForPid
2017-10-02 17:03:59,671 [cuckoo.core.startup] DEBUG:     |-- DeadHost
2017-10-02 17:03:59,671 [cuckoo.core.startup] DEBUG:     |-- NetworkBIND
2017-10-02 17:03:59,671 [cuckoo.core.startup] DEBUG:     |-- NetworkDynDNS
2017-10-02 17:03:59,671 [cuckoo.core.startup] DEBUG:     |-- NetworkHTTP
2017-10-02 17:03:59,671 [cuckoo.core.startup] DEBUG:     |-- NetworkICMP
2017-10-02 17:03:59,672 [cuckoo.core.startup] DEBUG:     |-- NetworkIRC
2017-10-02 17:03:59,672 [cuckoo.core.startup] DEBUG:     |-- NetworkSMTP
2017-10-02 17:03:59,672 [cuckoo.core.startup] DEBUG:     |-- SnortAlert
2017-10-02 17:03:59,672 [cuckoo.core.startup] DEBUG:     |-- SuricataAlert
2017-10-02 17:03:59,673 [cuckoo.core.startup] DEBUG:     |-- Suspicious_TLD
2017-10-02 17:03:59,673 [cuckoo.core.startup] DEBUG:     |-- TorGateway
2017-10-02 17:03:59,673 [cuckoo.core.startup] DEBUG:     |-- WscriptDownloader
2017-10-02 17:03:59,673 [cuckoo.core.startup] DEBUG:     |-- ADS
2017-10-02 17:03:59,674 [cuckoo.core.startup] DEBUG:     |-- Adzok
2017-10-02 17:03:59,674 [cuckoo.core.startup] DEBUG:     |-- AlinaFile
2017-10-02 17:03:59,674 [cuckoo.core.startup] DEBUG:     |-- AlineURL
2017-10-02 17:03:59,674 [cuckoo.core.startup] DEBUG:     |-- AllocatesRWX
2017-10-02 17:03:59,675 [cuckoo.core.startup] DEBUG:     |-- AmsiBypass
2017-10-02 17:03:59,675 [cuckoo.core.startup] DEBUG:     |-- Andromeda
2017-10-02 17:03:59,675 [cuckoo.core.startup] DEBUG:     |-- AntiAnalysisDetectFile
2017-10-02 17:03:59,675 [cuckoo.core.startup] DEBUG:     |-- AntiAVDetectFile
2017-10-02 17:03:59,675 [cuckoo.core.startup] DEBUG:     |-- AntiAVDetectReg
2017-10-02 17:03:59,675 [cuckoo.core.startup] DEBUG:     |-- AntiAVSRP
2017-10-02 17:03:59,676 [cuckoo.core.startup] DEBUG:     |-- AntiDBGDevices
2017-10-02 17:03:59,676 [cuckoo.core.startup] DEBUG:     |-- AntiDBGWindows
2017-10-02 17:03:59,676 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxFile
2017-10-02 17:03:59,676 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxForegroundWindow
2017-10-02 17:03:59,676 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxIdleTime
2017-10-02 17:03:59,676 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxRestart
2017-10-02 17:03:59,677 [cuckoo.core.startup] DEBUG:     |-- AntiSandboxSleep
2017-10-02 17:03:59,677 [cuckoo.core.startup] DEBUG:     |-- AntiVMBios
2017-10-02 17:03:59,677 [cuckoo.core.startup] DEBUG:     |-- AntiVMComputernameQuery
2017-10-02 17:03:59,677 [cuckoo.core.startup] DEBUG:     |-- AntiVMCPU
2017-10-02 17:03:59,677 [cuckoo.core.startup] DEBUG:     |-- AntiVMDiskSize
2017-10-02 17:03:59,678 [cuckoo.core.startup] DEBUG:     |-- AntiVMIDE
2017-10-02 17:03:59,678 [cuckoo.core.startup] DEBUG:     |-- AntiVMSCSI
2017-10-02 17:03:59,678 [cuckoo.core.startup] DEBUG:     |-- AntiVMServices
2017-10-02 17:03:59,678 [cuckoo.core.startup] DEBUG:     |-- AntiVMSharedDevice
2017-10-02 17:03:59,678 [cuckoo.core.startup] DEBUG:     |-- AppLockerBypass
2017-10-02 17:03:59,678 [cuckoo.core.startup] DEBUG:     |-- APT_Carbunak
2017-10-02 17:03:59,679 [cuckoo.core.startup] DEBUG:     |-- APT_CloudAtlas
2017-10-02 17:03:59,679 [cuckoo.core.startup] DEBUG:     |-- apt_sandworm_ip
2017-10-02 17:03:59,679 [cuckoo.core.startup] DEBUG:     |-- apt_sandworm_url
2017-10-02 17:03:59,679 [cuckoo.core.startup] DEBUG:     |-- ArdamaxMutexes
2017-10-02 17:03:59,679 [cuckoo.core.startup] DEBUG:     |-- AthenaHttp
2017-10-02 17:03:59,679 [cuckoo.core.startup] DEBUG:     |-- AthenaURL
2017-10-02 17:03:59,680 [cuckoo.core.startup] DEBUG:     |-- Autorun
2017-10-02 17:03:59,680 [cuckoo.core.startup] DEBUG:     |-- AvastDetectLibs
2017-10-02 17:03:59,680 [cuckoo.core.startup] DEBUG:     |-- AVDetectionChinaKey
2017-10-02 17:03:59,680 [cuckoo.core.startup] DEBUG:     |-- BadCerts
2017-10-02 17:03:59,680 [cuckoo.core.startup] DEBUG:     |-- Bagle
2017-10-02 17:03:59,681 [cuckoo.core.startup] DEBUG:     |-- Bandook
2017-10-02 17:03:59,681 [cuckoo.core.startup] DEBUG:     |-- banker_bancos
2017-10-02 17:03:59,681 [cuckoo.core.startup] DEBUG:     |-- BankingMutexes
2017-10-02 17:03:59,681 [cuckoo.core.startup] DEBUG:     |-- Banload
2017-10-02 17:03:59,681 [cuckoo.core.startup] DEBUG:     |-- Beastdoor
2017-10-02 17:03:59,681 [cuckoo.core.startup] DEBUG:     |-- BeebusMutexes
2017-10-02 17:03:59,682 [cuckoo.core.startup] DEBUG:     |-- BegseabugTDMutexes
2017-10-02 17:03:59,682 [cuckoo.core.startup] DEBUG:     |-- BetabotURL
2017-10-02 17:03:59,682 [cuckoo.core.startup] DEBUG:     |-- Bifrose
2017-10-02 17:03:59,682 [cuckoo.core.startup] DEBUG:     |-- BitcoinOpenCL
2017-10-02 17:03:59,682 [cuckoo.core.startup] DEBUG:     |-- BitcoinWallet
2017-10-02 17:03:59,683 [cuckoo.core.startup] DEBUG:     |-- BitdefenderDetectLibs
2017-10-02 17:03:59,683 [cuckoo.core.startup] DEBUG:     |-- BlackEnergyMutexes
2017-10-02 17:03:59,683 [cuckoo.core.startup] DEBUG:     |-- Blackhole
2017-10-02 17:03:59,683 [cuckoo.core.startup] DEBUG:     |-- BlackholeURL
2017-10-02 17:03:59,683 [cuckoo.core.startup] DEBUG:     |-- Blackice
2017-10-02 17:03:59,683 [cuckoo.core.startup] DEBUG:     |-- BlackposURL
2017-10-02 17:03:59,684 [cuckoo.core.startup] DEBUG:     |-- BlackRevMutexes
2017-10-02 17:03:59,684 [cuckoo.core.startup] DEBUG:     |-- Blackshades
2017-10-02 17:03:59,684 [cuckoo.core.startup] DEBUG:     |-- BladabindiMutexes
2017-10-02 17:03:59,684 [cuckoo.core.startup] DEBUG:     |-- BochsDetectKeys
2017-10-02 17:03:59,684 [cuckoo.core.startup] DEBUG:     |-- Bootkit
2017-10-02 17:03:59,685 [cuckoo.core.startup] DEBUG:     |-- Bottilda
2017-10-02 17:03:59,685 [cuckoo.core.startup] DEBUG:     |-- BozokKey
2017-10-02 17:03:59,685 [cuckoo.core.startup] DEBUG:     |-- browser_startpage
2017-10-02 17:03:59,685 [cuckoo.core.startup] DEBUG:     |-- BrowserSecurity
2017-10-02 17:03:59,685 [cuckoo.core.startup] DEBUG:     |-- BrowserStealer
2017-10-02 17:03:59,686 [cuckoo.core.startup] DEBUG:     |-- Btcbotnet
2017-10-02 17:03:59,686 [cuckoo.core.startup] DEBUG:     |-- Bublik
2017-10-02 17:03:59,686 [cuckoo.core.startup] DEBUG:     |-- BuildLangID
2017-10-02 17:03:59,686 [cuckoo.core.startup] DEBUG:     |-- BuzusMutexes
2017-10-02 17:03:59,686 [cuckoo.core.startup] DEBUG:     |-- BypassFirewall
2017-10-02 17:03:59,687 [cuckoo.core.startup] DEBUG:     |-- c24URL
2017-10-02 17:03:59,687 [cuckoo.core.startup] DEBUG:     |-- CarberpMutexes
2017-10-02 17:03:59,687 [cuckoo.core.startup] DEBUG:     |-- Ceatrg
2017-10-02 17:03:59,687 [cuckoo.core.startup] DEBUG:     |-- ChanitorMutexes
2017-10-02 17:03:59,687 [cuckoo.core.startup] DEBUG:     |-- CheckIP
2017-10-02 17:03:59,688 [cuckoo.core.startup] DEBUG:     |-- cloud_mediafire
2017-10-02 17:03:59,688 [cuckoo.core.startup] DEBUG:     |-- cloud_wetransfer
2017-10-02 17:03:59,688 [cuckoo.core.startup] DEBUG:     |-- CloudFlare
2017-10-02 17:03:59,688 [cuckoo.core.startup] DEBUG:     |-- CloudGoogle
2017-10-02 17:03:59,688 [cuckoo.core.startup] DEBUG:     |-- CoinminerMutexes
2017-10-02 17:03:59,689 [cuckoo.core.startup] DEBUG:     |-- ComRAT
2017-10-02 17:03:59,689 [cuckoo.core.startup] DEBUG:     |-- Crash
2017-10-02 17:03:59,689 [cuckoo.core.startup] DEBUG:     |-- CreatesAutorunInf
2017-10-02 17:03:59,689 [cuckoo.core.startup] DEBUG:     |-- CreatesDocument
2017-10-02 17:03:59,689 [cuckoo.core.startup] DEBUG:     |-- CreatesExe
2017-10-02 17:03:59,689 [cuckoo.core.startup] DEBUG:     |-- CreatesLargeKey
2017-10-02 17:03:59,689 [cuckoo.core.startup] DEBUG:     |-- CreatesService
2017-10-02 17:03:59,689 [cuckoo.core.startup] DEBUG:     |-- CreatesShortcut
2017-10-02 17:03:59,690 [cuckoo.core.startup] DEBUG:     |-- CreatesSuspiciousProcess
2017-10-02 17:03:59,690 [cuckoo.core.startup] DEBUG:     |-- Cridex
2017-10-02 17:03:59,690 [cuckoo.core.startup] DEBUG:     |-- CryptGenKey
2017-10-02 17:03:59,690 [cuckoo.core.startup] DEBUG:     |-- Cryptolocker
2017-10-02 17:03:59,690 [cuckoo.core.startup] DEBUG:     |-- CuckooDetectFiles
2017-10-02 17:03:59,690 [cuckoo.core.startup] DEBUG:     |-- Cybergate
2017-10-02 17:03:59,690 [cuckoo.core.startup] DEBUG:     |-- Dapato
2017-10-02 17:03:59,691 [cuckoo.core.startup] DEBUG:     |-- Darkcloud
2017-10-02 17:03:59,691 [cuckoo.core.startup] DEBUG:     |-- DarkddosMutexes
2017-10-02 17:03:59,691 [cuckoo.core.startup] DEBUG:     |-- Darkshell
2017-10-02 17:03:59,691 [cuckoo.core.startup] DEBUG:     |-- Ddos556
2017-10-02 17:03:59,691 [cuckoo.core.startup] DEBUG:     |-- Decay
2017-10-02 17:03:59,691 [cuckoo.core.startup] DEBUG:     |-- DecebalMutexes
2017-10-02 17:03:59,691 [cuckoo.core.startup] DEBUG:     |-- DeletesSelf
2017-10-02 17:03:59,692 [cuckoo.core.startup] DEBUG:     |-- DelfTrojan
2017-10-02 17:03:59,692 [cuckoo.core.startup] DEBUG:     |-- DEPHeapBypass
2017-10-02 17:03:59,692 [cuckoo.core.startup] DEBUG:     |-- DEPStackBypass
2017-10-02 17:03:59,692 [cuckoo.core.startup] DEBUG:     |-- DerusbiMutexes
2017-10-02 17:03:59,692 [cuckoo.core.startup] DEBUG:     |-- Dexter
2017-10-02 17:03:59,692 [cuckoo.core.startup] DEBUG:     |-- Dibik
2017-10-02 17:03:59,692 [cuckoo.core.startup] DEBUG:     |-- DirtJumper
2017-10-02 17:03:59,693 [cuckoo.core.startup] DEBUG:     |-- DisableCmd
2017-10-02 17:03:59,693 [cuckoo.core.startup] DEBUG:     |-- DisableRegedit
2017-10-02 17:03:59,693 [cuckoo.core.startup] DEBUG:     |-- DisablesAppLaunch
2017-10-02 17:03:59,693 [cuckoo.core.startup] DEBUG:     |-- DisablesBrowserWarn
2017-10-02 17:03:59,693 [cuckoo.core.startup] DEBUG:     |-- DisablesSecurity
2017-10-02 17:03:59,693 [cuckoo.core.startup] DEBUG:     |-- DisablesSPDY
2017-10-02 17:03:59,693 [cuckoo.core.startup] DEBUG:     |-- DisablesSystemRestore
2017-10-02 17:03:59,694 [cuckoo.core.startup] DEBUG:     |-- DisablesWER
2017-10-02 17:03:59,694 [cuckoo.core.startup] DEBUG:     |-- DisablesWindowsUpdate
2017-10-02 17:03:59,694 [cuckoo.core.startup] DEBUG:     |-- DisableTaskMgr
2017-10-02 17:03:59,694 [cuckoo.core.startup] DEBUG:     |-- DiskInformation
2017-10-02 17:03:59,694 [cuckoo.core.startup] DEBUG:     |-- DisplaysHTA
2017-10-02 17:03:59,694 [cuckoo.core.startup] DEBUG:     |-- Dns_Freehosting_Domain
2017-10-02 17:03:59,694 [cuckoo.core.startup] DEBUG:     |-- dnsserver_dynamic
2017-10-02 17:03:59,695 [cuckoo.core.startup] DEBUG:     |-- DocumentClose
2017-10-02 17:03:59,695 [cuckoo.core.startup] DEBUG:     |-- DocumentOpen
2017-10-02 17:03:59,695 [cuckoo.core.startup] DEBUG:     |-- DoFoil
2017-10-02 17:03:59,695 [cuckoo.core.startup] DEBUG:     |-- DownloaderCabby
2017-10-02 17:03:59,695 [cuckoo.core.startup] DEBUG:     |-- Dridex_APIs
2017-10-02 17:03:59,695 [cuckoo.core.startup] DEBUG:     |-- Drive
2017-10-02 17:03:59,695 [cuckoo.core.startup] DEBUG:     |-- Drive2
2017-10-02 17:03:59,696 [cuckoo.core.startup] DEBUG:     |-- DriverLoad
2017-10-02 17:03:59,696 [cuckoo.core.startup] DEBUG:     |-- DropBox
2017-10-02 17:03:59,696 [cuckoo.core.startup] DEBUG:     |-- Dropper
2017-10-02 17:03:59,696 [cuckoo.core.startup] DEBUG:     |-- Dyreza
2017-10-02 17:03:59,696 [cuckoo.core.startup] DEBUG:     |-- EclipseMutexes
2017-10-02 17:03:59,696 [cuckoo.core.startup] DEBUG:     |-- Emotet
2017-10-02 17:03:59,696 [cuckoo.core.startup] DEBUG:     |-- Emotet_APIs
2017-10-02 17:03:59,697 [cuckoo.core.startup] DEBUG:     |-- Evilbot
2017-10-02 17:03:59,697 [cuckoo.core.startup] DEBUG:     |-- ExecBitsAdmin
2017-10-02 17:03:59,697 [cuckoo.core.startup] DEBUG:     |-- ExecWaitFor
2017-10-02 17:03:59,697 [cuckoo.core.startup] DEBUG:     |-- exp_3322_dom
2017-10-02 17:03:59,697 [cuckoo.core.startup] DEBUG:     |-- Expiro
2017-10-02 17:03:59,697 [cuckoo.core.startup] DEBUG:     |-- ExploitHeapspray
2017-10-02 17:03:59,697 [cuckoo.core.startup] DEBUG:     |-- ExploitKitMutexes
2017-10-02 17:03:59,697 [cuckoo.core.startup] DEBUG:     |-- FakeAVMutexes
2017-10-02 17:03:59,698 [cuckoo.core.startup] DEBUG:     |-- FakeAVMutexes
2017-10-02 17:03:59,698 [cuckoo.core.startup] DEBUG:     |-- FakeRean
2017-10-02 17:03:59,698 [cuckoo.core.startup] DEBUG:     |-- FarFli
2017-10-02 17:03:59,698 [cuckoo.core.startup] DEBUG:     |-- FesberMutexes
2017-10-02 17:03:59,698 [cuckoo.core.startup] DEBUG:     |-- Fingerprint
2017-10-02 17:03:59,698 [cuckoo.core.startup] DEBUG:     |-- Flame
2017-10-02 17:03:59,698 [cuckoo.core.startup] DEBUG:     |-- Flystudio
2017-10-02 17:03:59,699 [cuckoo.core.startup] DEBUG:     |-- FortinetDetectFiles
2017-10-02 17:03:59,699 [cuckoo.core.startup] DEBUG:     |-- FTPStealer
2017-10-02 17:03:59,699 [cuckoo.core.startup] DEBUG:     |-- Fynloski
2017-10-02 17:03:59,699 [cuckoo.core.startup] DEBUG:     |-- Gaelicum
2017-10-02 17:03:59,699 [cuckoo.core.startup] DEBUG:     |-- Ghostbot
2017-10-02 17:03:59,699 [cuckoo.core.startup] DEBUG:     |-- HasAuthenticode
2017-10-02 17:03:59,699 [cuckoo.core.startup] DEBUG:     |-- HasOfficeEps
2017-10-02 17:03:59,699 [cuckoo.core.startup] DEBUG:     |-- HasPdb
2017-10-02 17:03:59,700 [cuckoo.core.startup] DEBUG:     |-- HasWMI
2017-10-02 17:03:59,700 [cuckoo.core.startup] DEBUG:     |-- Hesperbot
2017-10-02 17:03:59,700 [cuckoo.core.startup] DEBUG:     |-- Hidden_Window
2017-10-02 17:03:59,700 [cuckoo.core.startup] DEBUG:     |-- Hikit
2017-10-02 17:03:59,700 [cuckoo.core.startup] DEBUG:     |-- HookMouse
2017-10-02 17:03:59,700 [cuckoo.core.startup] DEBUG:     |-- Hupigon
2017-10-02 17:03:59,700 [cuckoo.core.startup] DEBUG:     |-- HyperVDetectKeys
2017-10-02 17:03:59,701 [cuckoo.core.startup] DEBUG:     |-- IcePoint
2017-10-02 17:03:59,701 [cuckoo.core.startup] DEBUG:     |-- im_btb
2017-10-02 17:03:59,701 [cuckoo.core.startup] DEBUG:     |-- im_qq
2017-10-02 17:03:59,701 [cuckoo.core.startup] DEBUG:     |-- IMStealer
2017-10-02 17:03:59,701 [cuckoo.core.startup] DEBUG:     |-- InceptionAPT
2017-10-02 17:03:59,701 [cuckoo.core.startup] DEBUG:     |-- Infinity
2017-10-02 17:03:59,701 [cuckoo.core.startup] DEBUG:     |-- InjectionRunPE
2017-10-02 17:03:59,701 [cuckoo.core.startup] DEBUG:     |-- InjectionThread
2017-10-02 17:03:59,702 [cuckoo.core.startup] DEBUG:     |-- InstalledApps
2017-10-02 17:03:59,702 [cuckoo.core.startup] DEBUG:     |-- InstallsAppInit
2017-10-02 17:03:59,702 [cuckoo.core.startup] DEBUG:     |-- InstallsBHO
2017-10-02 17:03:59,702 [cuckoo.core.startup] DEBUG:     |-- InstallsWinpcap
2017-10-02 17:03:59,702 [cuckoo.core.startup] DEBUG:     |-- IPKillerMutexes
2017-10-02 17:03:59,702 [cuckoo.core.startup] DEBUG:     |-- Ircbrute
2017-10-02 17:03:59,703 [cuckoo.core.startup] DEBUG:     |-- ISRstealerURL
2017-10-02 17:03:59,703 [cuckoo.core.startup] DEBUG:     |-- iStealerURL
2017-10-02 17:03:59,703 [cuckoo.core.startup] DEBUG:     |-- JackPOSFile
2017-10-02 17:03:59,703 [cuckoo.core.startup] DEBUG:     |-- JackposURL
2017-10-02 17:03:59,703 [cuckoo.core.startup] DEBUG:     |-- JeefoMutexes
2017-10-02 17:03:59,703 [cuckoo.core.startup] DEBUG:     |-- Jewdo
2017-10-02 17:03:59,703 [cuckoo.core.startup] DEBUG:     |-- JintorMutexes
2017-10-02 17:03:59,704 [cuckoo.core.startup] DEBUG:     |-- JorikTrojan
2017-10-02 17:03:59,704 [cuckoo.core.startup] DEBUG:     |-- Karagany
2017-10-02 17:03:59,704 [cuckoo.core.startup] DEBUG:     |-- Karakum
2017-10-02 17:03:59,704 [cuckoo.core.startup] DEBUG:     |-- Katusha
2017-10-02 17:03:59,704 [cuckoo.core.startup] DEBUG:     |-- KelihosBot
2017-10-02 17:03:59,704 [cuckoo.core.startup] DEBUG:     |-- Keylogger
2017-10-02 17:03:59,704 [cuckoo.core.startup] DEBUG:     |-- Kilim
2017-10-02 17:03:59,705 [cuckoo.core.startup] DEBUG:     |-- Killdisk
2017-10-02 17:03:59,705 [cuckoo.core.startup] DEBUG:     |-- KnownVirustotal
2017-10-02 17:03:59,705 [cuckoo.core.startup] DEBUG:     |-- Koobface
2017-10-02 17:03:59,705 [cuckoo.core.startup] DEBUG:     |-- Koutodoor
2017-10-02 17:03:59,705 [cuckoo.core.startup] DEBUG:     |-- KovterBot
2017-10-02 17:03:59,705 [cuckoo.core.startup] DEBUG:     |-- KrepperMutexes
2017-10-02 17:03:59,705 [cuckoo.core.startup] DEBUG:     |-- KuluozMutexes
2017-10-02 17:03:59,706 [cuckoo.core.startup] DEBUG:     |-- Likseput
2017-10-02 17:03:59,706 [cuckoo.core.startup] DEBUG:     |-- LocatesBrowser
2017-10-02 17:03:59,706 [cuckoo.core.startup] DEBUG:     |-- LocatesSniffer
2017-10-02 17:03:59,706 [cuckoo.core.startup] DEBUG:     |-- Lockscreen
2017-10-02 17:03:59,706 [cuckoo.core.startup] DEBUG:     |-- LolBot
2017-10-02 17:03:59,706 [cuckoo.core.startup] DEBUG:     |-- Luder
2017-10-02 17:03:59,706 [cuckoo.core.startup] DEBUG:     |-- Madness
2017-10-02 17:03:59,707 [cuckoo.core.startup] DEBUG:     |-- Madness
2017-10-02 17:03:59,707 [cuckoo.core.startup] DEBUG:     |-- MadnessURL
2017-10-02 17:03:59,707 [cuckoo.core.startup] DEBUG:     |-- MaganiaMutexes
2017-10-02 17:03:59,707 [cuckoo.core.startup] DEBUG:     |-- MailStealer
2017-10-02 17:03:59,707 [cuckoo.core.startup] DEBUG:     |-- MaliciousDocumentURLs
2017-10-02 17:03:59,707 [cuckoo.core.startup] DEBUG:     |-- MegaUpload
2017-10-02 17:03:59,707 [cuckoo.core.startup] DEBUG:     |-- MemoryAvailable
2017-10-02 17:03:59,708 [cuckoo.core.startup] DEBUG:     |-- MetasploitShellcode
2017-10-02 17:03:59,708 [cuckoo.core.startup] DEBUG:     |-- Minerbot
2017-10-02 17:03:59,708 [cuckoo.core.startup] DEBUG:     |-- miningpool
2017-10-02 17:03:59,708 [cuckoo.core.startup] DEBUG:     |-- MircFile
2017-10-02 17:03:59,708 [cuckoo.core.startup] DEBUG:     |-- ModifiesBootConfig
2017-10-02 17:03:59,708 [cuckoo.core.startup] DEBUG:     |-- ModifiesCertificates
2017-10-02 17:03:59,708 [cuckoo.core.startup] DEBUG:     |-- ModifiesDesktopWallpaper
2017-10-02 17:03:59,709 [cuckoo.core.startup] DEBUG:     |-- ModifiesUACNotify
2017-10-02 17:03:59,709 [cuckoo.core.startup] DEBUG:     |-- ModifySecurityCenterWarnings
2017-10-02 17:03:59,709 [cuckoo.core.startup] DEBUG:     |-- Multiple_UA
2017-10-02 17:03:59,709 [cuckoo.core.startup] DEBUG:     |-- MyBot
2017-10-02 17:03:59,709 [cuckoo.core.startup] DEBUG:     |-- Nakbot
2017-10-02 17:03:59,709 [cuckoo.core.startup] DEBUG:     |-- Napolar
2017-10-02 17:03:59,709 [cuckoo.core.startup] DEBUG:     |-- Nebuler
2017-10-02 17:03:59,710 [cuckoo.core.startup] DEBUG:     |-- Netobserve
2017-10-02 17:03:59,710 [cuckoo.core.startup] DEBUG:     |-- Netshadow
2017-10-02 17:03:59,710 [cuckoo.core.startup] DEBUG:     |-- Netwire
2017-10-02 17:03:59,710 [cuckoo.core.startup] DEBUG:     |-- NetworkAdapters
2017-10-02 17:03:59,710 [cuckoo.core.startup] DEBUG:     |-- NetworkC2Details
2017-10-02 17:03:59,710 [cuckoo.core.startup] DEBUG:     |-- NetworkDocumentFile
2017-10-02 17:03:59,710 [cuckoo.core.startup] DEBUG:     |-- NetworkEXE
2017-10-02 17:03:59,711 [cuckoo.core.startup] DEBUG:     |-- Nitol
2017-10-02 17:03:59,711 [cuckoo.core.startup] DEBUG:     |-- NjRat
2017-10-02 17:03:59,711 [cuckoo.core.startup] DEBUG:     |-- ObfusMutexes
2017-10-02 17:03:59,711 [cuckoo.core.startup] DEBUG:     |-- OfficeCheckName
2017-10-02 17:03:59,711 [cuckoo.core.startup] DEBUG:     |-- OfficeCheckProjectName
2017-10-02 17:03:59,711 [cuckoo.core.startup] DEBUG:     |-- OfficeCheckVersion
2017-10-02 17:03:59,711 [cuckoo.core.startup] DEBUG:     |-- OfficeCheckWindow
2017-10-02 17:03:59,712 [cuckoo.core.startup] DEBUG:     |-- OfficeCountDirectories
2017-10-02 17:03:59,712 [cuckoo.core.startup] DEBUG:     |-- OfficeCreateObject
2017-10-02 17:03:59,712 [cuckoo.core.startup] DEBUG:     |-- OfficeEpsStrings
2017-10-02 17:03:59,712 [cuckoo.core.startup] DEBUG:     |-- OfficeHttpRequest
2017-10-02 17:03:59,712 [cuckoo.core.startup] DEBUG:     |-- OfficeIndirectCall
2017-10-02 17:03:59,712 [cuckoo.core.startup] DEBUG:     |-- OfficePackager
2017-10-02 17:03:59,712 [cuckoo.core.startup] DEBUG:     |-- OfficePlatformDetect
2017-10-02 17:03:59,713 [cuckoo.core.startup] DEBUG:     |-- OfficeRecentFiles
2017-10-02 17:03:59,713 [cuckoo.core.startup] DEBUG:     |-- OfficeVulnerableGuid
2017-10-02 17:03:59,713 [cuckoo.core.startup] DEBUG:     |-- OfficeVulnModules
2017-10-02 17:03:59,713 [cuckoo.core.startup] DEBUG:     |-- Oldrea
2017-10-02 17:03:59,713 [cuckoo.core.startup] DEBUG:     |-- OverwritesFiles
2017-10-02 17:03:59,713 [cuckoo.core.startup] DEBUG:     |-- PackerEntropy
2017-10-02 17:03:59,713 [cuckoo.core.startup] DEBUG:     |-- Palevo
2017-10-02 17:03:59,713 [cuckoo.core.startup] DEBUG:     |-- ParallelsDetectKeys
2017-10-02 17:03:59,714 [cuckoo.core.startup] DEBUG:     |-- Pasta
2017-10-02 17:03:59,714 [cuckoo.core.startup] DEBUG:     |-- PcClientMutexes
2017-10-02 17:03:59,714 [cuckoo.core.startup] DEBUG:     |-- PEFeatures
2017-10-02 17:03:59,714 [cuckoo.core.startup] DEBUG:     |-- PEIDPacker
2017-10-02 17:03:59,714 [cuckoo.core.startup] DEBUG:     |-- PerfLogger
2017-10-02 17:03:59,714 [cuckoo.core.startup] DEBUG:     |-- PersistanceRegJavaScript
2017-10-02 17:03:59,714 [cuckoo.core.startup] DEBUG:     |-- PersistenceBootexecute
2017-10-02 17:03:59,715 [cuckoo.core.startup] DEBUG:     |-- Phorpiex
2017-10-02 17:03:59,715 [cuckoo.core.startup] DEBUG:     |-- Pidief
2017-10-02 17:03:59,715 [cuckoo.core.startup] DEBUG:     |-- Plugx
2017-10-02 17:03:59,715 [cuckoo.core.startup] DEBUG:     |-- Poebot
2017-10-02 17:03:59,715 [cuckoo.core.startup] DEBUG:     |-- PoisonIvy
2017-10-02 17:03:59,715 [cuckoo.core.startup] DEBUG:     |-- Polymorphic
2017-10-02 17:03:59,715 [cuckoo.core.startup] DEBUG:     |-- Ponfoy
2017-10-02 17:03:59,716 [cuckoo.core.startup] DEBUG:     |-- PonyURL
2017-10-02 17:03:59,716 [cuckoo.core.startup] DEBUG:     |-- PosCardStealerURL
2017-10-02 17:03:59,716 [cuckoo.core.startup] DEBUG:     |-- Powerfun
2017-10-02 17:03:59,716 [cuckoo.core.startup] DEBUG:     |-- PowershellBitsTransfer
2017-10-02 17:03:59,716 [cuckoo.core.startup] DEBUG:     |-- PowershellCcDns
2017-10-02 17:03:59,716 [cuckoo.core.startup] DEBUG:     |-- PowershellDdiRc4
2017-10-02 17:03:59,716 [cuckoo.core.startup] DEBUG:     |-- PowershellDFSP
2017-10-02 17:03:59,717 [cuckoo.core.startup] DEBUG:     |-- PowershellDI
2017-10-02 17:03:59,717 [cuckoo.core.startup] DEBUG:     |-- PowershellDownload
2017-10-02 17:03:59,717 [cuckoo.core.startup] DEBUG:     |-- PowershellEmpire
2017-10-02 17:03:59,717 [cuckoo.core.startup] DEBUG:     |-- PowershellMeterpreter
2017-10-02 17:03:59,717 [cuckoo.core.startup] DEBUG:     |-- PowershellRegAdd
2017-10-02 17:03:59,717 [cuckoo.core.startup] DEBUG:     |-- PowershellRequest
2017-10-02 17:03:59,717 [cuckoo.core.startup] DEBUG:     |-- PowershellUnicorn
2017-10-02 17:03:59,717 [cuckoo.core.startup] DEBUG:     |-- Powerworm
2017-10-02 17:03:59,718 [cuckoo.core.startup] DEBUG:     |-- Prinimalka
2017-10-02 17:03:59,718 [cuckoo.core.startup] DEBUG:     |-- ProcessInterest
2017-10-02 17:03:59,718 [cuckoo.core.startup] DEBUG:     |-- ProcessMartian
2017-10-02 17:03:59,718 [cuckoo.core.startup] DEBUG:     |-- ProcessNeeded
2017-10-02 17:03:59,718 [cuckoo.core.startup] DEBUG:     |-- ProcMemDumpIPURLs
2017-10-02 17:03:59,718 [cuckoo.core.startup] DEBUG:     |-- ProcMemDumpTORURLs
2017-10-02 17:03:59,718 [cuckoo.core.startup] DEBUG:     |-- ProcMemDumpURLs
2017-10-02 17:03:59,719 [cuckoo.core.startup] DEBUG:     |-- ProcMemDumpYara
2017-10-02 17:03:59,719 [cuckoo.core.startup] DEBUG:     |-- Psyokym
2017-10-02 17:03:59,719 [cuckoo.core.startup] DEBUG:     |-- PuceMutexes
2017-10-02 17:03:59,719 [cuckoo.core.startup] DEBUG:     |-- PutterpandaMutexes
2017-10-02 17:03:59,719 [cuckoo.core.startup] DEBUG:     |-- Putty
2017-10-02 17:03:59,719 [cuckoo.core.startup] DEBUG:     |-- PWDumpFile
2017-10-02 17:03:59,719 [cuckoo.core.startup] DEBUG:     |-- Pykse
2017-10-02 17:03:59,719 [cuckoo.core.startup] DEBUG:     |-- Qakbot
2017-10-02 17:03:59,720 [cuckoo.core.startup] DEBUG:     |-- Ragebot
2017-10-02 17:03:59,720 [cuckoo.core.startup] DEBUG:     |-- RaisesException
2017-10-02 17:03:59,720 [cuckoo.core.startup] DEBUG:     |-- Ramnit
2017-10-02 17:03:59,720 [cuckoo.core.startup] DEBUG:     |-- RamsomwareFileMoves
2017-10-02 17:03:59,720 [cuckoo.core.startup] DEBUG:     |-- ransomware_viruscoder
2017-10-02 17:03:59,720 [cuckoo.core.startup] DEBUG:     |-- RansomwareAppendsExtension
2017-10-02 17:03:59,720 [cuckoo.core.startup] DEBUG:     |-- RansomwareBcdedit
2017-10-02 17:03:59,720 [cuckoo.core.startup] DEBUG:     |-- RansomwareDroppedFiles
2017-10-02 17:03:59,721 [cuckoo.core.startup] DEBUG:     |-- RansomwareExtensions
2017-10-02 17:03:59,721 [cuckoo.core.startup] DEBUG:     |-- RansomwareFiles
2017-10-02 17:03:59,721 [cuckoo.core.startup] DEBUG:     |-- RansomwareMessage
2017-10-02 17:03:59,721 [cuckoo.core.startup] DEBUG:     |-- RansomwareRecyclebin
2017-10-02 17:03:59,721 [cuckoo.core.startup] DEBUG:     |-- RansomwareShadowcopy
2017-10-02 17:03:59,721 [cuckoo.core.startup] DEBUG:     |-- RapidShare
2017-10-02 17:03:59,721 [cuckoo.core.startup] DEBUG:     |-- rat_fexel_ip
2017-10-02 17:03:59,721 [cuckoo.core.startup] DEBUG:     |-- rat_naid_ip
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- RatSiggen
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- RBot
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- RdpMutexes
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- Recon_Beacon
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- RemovesZoneIdADS
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- Renocide
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- RenosTrojan
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- Rovnix
2017-10-02 17:03:59,722 [cuckoo.core.startup] DEBUG:     |-- Runbu
2017-10-02 17:03:59,723 [cuckoo.core.startup] DEBUG:     |-- RunouceMutexes
2017-10-02 17:03:59,723 [cuckoo.core.startup] DEBUG:     |-- Ruskill
2017-10-02 17:03:59,723 [cuckoo.core.startup] DEBUG:     |-- Sadbot
2017-10-02 17:03:59,723 [cuckoo.core.startup] DEBUG:     |-- SandboxieDetect
2017-10-02 17:03:59,723 [cuckoo.core.startup] DEBUG:     |-- SandboxJoeAnubisDetectFiles
2017-10-02 17:03:59,723 [cuckoo.core.startup] DEBUG:     |-- SDBot
2017-10-02 17:03:59,723 [cuckoo.core.startup] DEBUG:     |-- SelfDeleteBat
2017-10-02 17:03:59,723 [cuckoo.core.startup] DEBUG:     |-- Senna
2017-10-02 17:03:59,724 [cuckoo.core.startup] DEBUG:     |-- Shadowbot
2017-10-02 17:03:59,724 [cuckoo.core.startup] DEBUG:     |-- SharingRGhost
2017-10-02 17:03:59,724 [cuckoo.core.startup] DEBUG:     |-- SharpStealerURL
2017-10-02 17:03:59,724 [cuckoo.core.startup] DEBUG:     |-- ShellcodeWriteProcessMemory
2017-10-02 17:03:59,724 [cuckoo.core.startup] DEBUG:     |-- Shiz
2017-10-02 17:03:59,724 [cuckoo.core.startup] DEBUG:     |-- Shylock
2017-10-02 17:03:59,724 [cuckoo.core.startup] DEBUG:     |-- SipStun
2017-10-02 17:03:59,725 [cuckoo.core.startup] DEBUG:     |-- Smtp_GMail
2017-10-02 17:03:59,725 [cuckoo.core.startup] DEBUG:     |-- Smtp_Live
2017-10-02 17:03:59,725 [cuckoo.core.startup] DEBUG:     |-- Smtp_Mail_Ru
2017-10-02 17:03:59,725 [cuckoo.core.startup] DEBUG:     |-- Smtp_Yahoo
2017-10-02 17:03:59,725 [cuckoo.core.startup] DEBUG:     |-- SolarURL
2017-10-02 17:03:59,725 [cuckoo.core.startup] DEBUG:     |-- SpyEyeMutexes
2017-10-02 17:03:59,725 [cuckoo.core.startup] DEBUG:     |-- SpyeyeURL
2017-10-02 17:03:59,725 [cuckoo.core.startup] DEBUG:     |-- SpynetRat
2017-10-02 17:03:59,726 [cuckoo.core.startup] DEBUG:     |-- Spyrecorder
2017-10-02 17:03:59,726 [cuckoo.core.startup] DEBUG:     |-- StackPivot
2017-10-02 17:03:59,726 [cuckoo.core.startup] DEBUG:     |-- StackPivotDllLoad
2017-10-02 17:03:59,726 [cuckoo.core.startup] DEBUG:     |-- Staser
2017-10-02 17:03:59,726 [cuckoo.core.startup] DEBUG:     |-- StealthChildProc
2017-10-02 17:03:59,726 [cuckoo.core.startup] DEBUG:     |-- StealthHiddenExtension
2017-10-02 17:03:59,726 [cuckoo.core.startup] DEBUG:     |-- StealthHiddenFile
2017-10-02 17:03:59,727 [cuckoo.core.startup] DEBUG:     |-- StealthHiddenIcons
2017-10-02 17:03:59,727 [cuckoo.core.startup] DEBUG:     |-- StopsService
2017-10-02 17:03:59,727 [cuckoo.core.startup] DEBUG:     |-- SunbeltDetectFiles
2017-10-02 17:03:59,727 [cuckoo.core.startup] DEBUG:     |-- SunBeltSandboxDetect
2017-10-02 17:03:59,727 [cuckoo.core.startup] DEBUG:     |-- SuspiciousCommandTools
2017-10-02 17:03:59,727 [cuckoo.core.startup] DEBUG:     |-- SuspiciousPowershell
2017-10-02 17:03:59,727 [cuckoo.core.startup] DEBUG:     |-- SuspiciousWriteEXE
2017-10-02 17:03:59,727 [cuckoo.core.startup] DEBUG:     |-- SweetorangeMutexes
2017-10-02 17:03:59,728 [cuckoo.core.startup] DEBUG:     |-- Swrort
2017-10-02 17:03:59,728 [cuckoo.core.startup] DEBUG:     |-- SystemInfo
2017-10-02 17:03:59,728 [cuckoo.core.startup] DEBUG:     |-- SystemMetrics
2017-10-02 17:03:59,728 [cuckoo.core.startup] DEBUG:     |-- TapiDpMutexes
2017-10-02 17:03:59,728 [cuckoo.core.startup] DEBUG:     |-- TDSSBackdoor
2017-10-02 17:03:59,728 [cuckoo.core.startup] DEBUG:     |-- TeamviewerRat
2017-10-02 17:03:59,728 [cuckoo.core.startup] DEBUG:     |-- ThreatTrackDetectFiles
2017-10-02 17:03:59,729 [cuckoo.core.startup] DEBUG:     |-- TinbaMutexes
2017-10-02 17:03:59,729 [cuckoo.core.startup] DEBUG:     |-- TnegaMutexes
2017-10-02 17:03:59,729 [cuckoo.core.startup] DEBUG:     |-- Tor
2017-10-02 17:03:59,729 [cuckoo.core.startup] DEBUG:     |-- TorHiddenService
2017-10-02 17:03:59,729 [cuckoo.core.startup] DEBUG:     |-- Travnet
2017-10-02 17:03:59,729 [cuckoo.core.startup] DEBUG:     |-- Trogbot
2017-10-02 17:03:59,729 [cuckoo.core.startup] DEBUG:     |-- TrojanJorik
2017-10-02 17:03:59,729 [cuckoo.core.startup] DEBUG:     |-- TrojanLethic
2017-10-02 17:03:59,730 [cuckoo.core.startup] DEBUG:     |-- TrojanLethic
2017-10-02 17:03:59,730 [cuckoo.core.startup] DEBUG:     |-- trojanmrblack
2017-10-02 17:03:59,730 [cuckoo.core.startup] DEBUG:     |-- TrojanRedosru
2017-10-02 17:03:59,730 [cuckoo.core.startup] DEBUG:     |-- TrojanSysn
2017-10-02 17:03:59,730 [cuckoo.core.startup] DEBUG:     |-- trojanyoddos
2017-10-02 17:03:59,730 [cuckoo.core.startup] DEBUG:     |-- TufikMutexes
2017-10-02 17:03:59,730 [cuckoo.core.startup] DEBUG:     |-- Turkojan
2017-10-02 17:03:59,731 [cuckoo.core.startup] DEBUG:     |-- TurlaCarbon
2017-10-02 17:03:59,731 [cuckoo.core.startup] DEBUG:     |-- UFRStealer
2017-10-02 17:03:59,731 [cuckoo.core.startup] DEBUG:     |-- Unhook
2017-10-02 17:03:59,731 [cuckoo.core.startup] DEBUG:     |-- Upatre
2017-10-02 17:03:59,731 [cuckoo.core.startup] DEBUG:     |-- UpatreTDMutexes
2017-10-02 17:03:59,731 [cuckoo.core.startup] DEBUG:     |-- UPXCompressed
2017-10-02 17:03:59,731 [cuckoo.core.startup] DEBUG:     |-- UrkShortCN
2017-10-02 17:03:59,731 [cuckoo.core.startup] DEBUG:     |-- URLSpy
2017-10-02 17:03:59,732 [cuckoo.core.startup] DEBUG:     |-- UroburosFile
2017-10-02 17:03:59,732 [cuckoo.core.startup] DEBUG:     |-- UroburosMutexes
2017-10-02 17:03:59,732 [cuckoo.core.startup] DEBUG:     |-- Urxbot
2017-10-02 17:03:59,732 [cuckoo.core.startup] DEBUG:     |-- UsesWindowsUtilities
2017-10-02 17:03:59,732 [cuckoo.core.startup] DEBUG:     |-- Vanbot
2017-10-02 17:03:59,732 [cuckoo.core.startup] DEBUG:     |-- VBInject
2017-10-02 17:03:59,732 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectACPI
2017-10-02 17:03:59,733 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectDevices
2017-10-02 17:03:59,733 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectFiles
2017-10-02 17:03:59,733 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectKeys
2017-10-02 17:03:59,733 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectProvname
2017-10-02 17:03:59,733 [cuckoo.core.startup] DEBUG:     |-- VBoxDetectWindow
2017-10-02 17:03:59,733 [cuckoo.core.startup] DEBUG:     |-- Vertex
2017-10-02 17:03:59,733 [cuckoo.core.startup] DEBUG:     |-- VertexSolarURL
2017-10-02 17:03:59,733 [cuckoo.core.startup] DEBUG:     |-- VirtualPCDetect
2017-10-02 17:03:59,734 [cuckoo.core.startup] DEBUG:     |-- VirtualPCIllegalInstruction
2017-10-02 17:03:59,734 [cuckoo.core.startup] DEBUG:     |-- Virut
2017-10-02 17:03:59,734 [cuckoo.core.startup] DEBUG:     |-- VMFirmware
2017-10-02 17:03:59,734 [cuckoo.core.startup] DEBUG:     |-- VMPPacked
2017-10-02 17:03:59,734 [cuckoo.core.startup] DEBUG:     |-- VMWareDetectFiles
2017-10-02 17:03:59,734 [cuckoo.core.startup] DEBUG:     |-- VMWareDetectKeys
2017-10-02 17:03:59,734 [cuckoo.core.startup] DEBUG:     |-- VMWareInInstruction
2017-10-02 17:03:59,735 [cuckoo.core.startup] DEBUG:     |-- VncMutexes
2017-10-02 17:03:59,735 [cuckoo.core.startup] DEBUG:     |-- VNLoaderURL
2017-10-02 17:03:59,735 [cuckoo.core.startup] DEBUG:     |-- VolDevicetree1
2017-10-02 17:03:59,735 [cuckoo.core.startup] DEBUG:     |-- VolHandles1
2017-10-02 17:03:59,735 [cuckoo.core.startup] DEBUG:     |-- VolLdrModules1
2017-10-02 17:03:59,735 [cuckoo.core.startup] DEBUG:     |-- VolLdrModules2
2017-10-02 17:03:59,735 [cuckoo.core.startup] DEBUG:     |-- VolMalfind1
2017-10-02 17:03:59,736 [cuckoo.core.startup] DEBUG:     |-- VolModscan1
2017-10-02 17:03:59,736 [cuckoo.core.startup] DEBUG:     |-- VolSvcscan1
2017-10-02 17:03:59,736 [cuckoo.core.startup] DEBUG:     |-- VolSvcscan2
2017-10-02 17:03:59,736 [cuckoo.core.startup] DEBUG:     |-- VolSvcscan3
2017-10-02 17:03:59,736 [cuckoo.core.startup] DEBUG:     |-- VPCDetectKeys
2017-10-02 17:03:59,736 [cuckoo.core.startup] DEBUG:     |-- Wakbot
2017-10-02 17:03:59,736 [cuckoo.core.startup] DEBUG:     |-- WarbotURL
2017-10-02 17:03:59,737 [cuckoo.core.startup] DEBUG:     |-- Whimoo
2017-10-02 17:03:59,737 [cuckoo.core.startup] DEBUG:     |-- Win32ProcessCreate
2017-10-02 17:03:59,737 [cuckoo.core.startup] DEBUG:     |-- WineDetect
2017-10-02 17:03:59,737 [cuckoo.core.startup] DEBUG:     |-- WinSCP
2017-10-02 17:03:59,737 [cuckoo.core.startup] DEBUG:     |-- WinSxsBot
2017-10-02 17:03:59,737 [cuckoo.core.startup] DEBUG:     |-- WMIAntiVM
2017-10-02 17:03:59,737 [cuckoo.core.startup] DEBUG:     |-- WormAllaple
2017-10-02 17:03:59,737 [cuckoo.core.startup] DEBUG:     |-- WormKolabc
2017-10-02 17:03:59,738 [cuckoo.core.startup] DEBUG:     |-- XenDetectKeys
2017-10-02 17:03:59,738 [cuckoo.core.startup] DEBUG:     |-- XtremeRAT
2017-10-02 17:03:59,738 [cuckoo.core.startup] DEBUG:     |-- Xworm
2017-10-02 17:03:59,738 [cuckoo.core.startup] DEBUG:     |-- Zegost
2017-10-02 17:03:59,738 [cuckoo.core.startup] DEBUG:     |-- ZeusMutexes
2017-10-02 17:03:59,738 [cuckoo.core.startup] DEBUG:     |-- ZeusP2P
2017-10-02 17:03:59,738 [cuckoo.core.startup] DEBUG:     |-- ZeusURL
2017-10-02 17:03:59,738 [cuckoo.core.startup] DEBUG:     `-- ZoneID
2017-10-02 17:03:59,739 [cuckoo.core.startup] DEBUG: Imported "reporting" modules:
2017-10-02 17:03:59,739 [cuckoo.core.startup] DEBUG:     |-- ElasticSearch
2017-10-02 17:03:59,739 [cuckoo.core.startup] DEBUG:     |-- Feedback
2017-10-02 17:03:59,739 [cuckoo.core.startup] DEBUG:     |-- JsonDump
2017-10-02 17:03:59,739 [cuckoo.core.startup] DEBUG:     |-- Mattermost
2017-10-02 17:03:59,739 [cuckoo.core.startup] DEBUG:     |-- MISP
2017-10-02 17:03:59,739 [cuckoo.core.startup] DEBUG:     |-- Moloch
2017-10-02 17:03:59,740 [cuckoo.core.startup] DEBUG:     |-- MongoDB
2017-10-02 17:03:59,740 [cuckoo.core.startup] DEBUG:     |-- Notification
2017-10-02 17:03:59,740 [cuckoo.core.startup] DEBUG:     `-- SingleFile
2017-10-02 17:03:59,748 [cuckoo.core.startup] DEBUG: Checking for locked tasks..
2017-10-02 17:04:00,056 [cuckoo.core.startup] INFO: Updated running task ID 5 status to failed_analysis
2017-10-02 17:04:00,056 [cuckoo.core.startup] DEBUG: Checking for pending service tasks..
2017-10-02 17:04:00,073 [cuckoo.core.startup] DEBUG: Initializing Yara...
2017-10-02 17:04:00,074 [cuckoo.core.startup] DEBUG:     |-- binaries embedded.yar
2017-10-02 17:04:00,075 [cuckoo.core.startup] DEBUG:     |-- binaries shellcodes.yar
2017-10-02 17:04:00,075 [cuckoo.core.startup] DEBUG:     |-- binaries vmdetect.yar
2017-10-02 17:04:00,077 [cuckoo.core.startup] DEBUG:     |-- scripts applocker_bypass.yar
2017-10-02 17:04:00,077 [cuckoo.core.startup] DEBUG:     |-- scripts powerfun.yar
2017-10-02 17:04:00,077 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_AMSI.yar
2017-10-02 17:04:00,077 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_BITS_transfer.yar
2017-10-02 17:04:00,077 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_ddi_rc4.yar
2017-10-02 17:04:00,078 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_dfsp.yar
2017-10-02 17:04:00,078 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_di.yar
2017-10-02 17:04:00,078 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_empire.yar
2017-10-02 17:04:00,078 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_meterpreter.yar
2017-10-02 17:04:00,078 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_txt_c2.yar
2017-10-02 17:04:00,078 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_unicorn.yar
2017-10-02 17:04:00,078 [cuckoo.core.startup] DEBUG:     |-- scripts powerworm.yar
2017-10-02 17:04:00,079 [cuckoo.core.startup] DEBUG:     |-- shellcode metasploit.yar
2017-10-02 17:04:00,165 [cuckoo.core.resultserver] DEBUG: ResultServer running on 192.168.56.1:2042.
2017-10-02 17:04:00,167 [cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager
2017-10-02 17:04:00,771 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine cuckoo1 to its current snapshot
2017-10-02 17:04:01,254 [cuckoo.core.scheduler] INFO: Loaded 1 machine/s
2017-10-02 17:04:01,269 [cuckoo.core.scheduler] INFO: Waiting for analysis tasks.
2017-10-02 17:04:03,436 [cuckoo.core.scheduler] DEBUG: Processing task #6
2017-10-02 17:04:03,451 [cuckoo.core.scheduler] INFO: Starting analysis of FILE "5af426173e9c4aa8b8d9b3aa8475cb678f2ac6861cd42f48d426e5d7dcc9626f" (task #6, options "")
2017-10-02 17:04:03,572 [cuckoo.core.scheduler] INFO: Task #6: acquired machine cuckoo1 (label=cuckoo1)
2017-10-02 17:04:03,583 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 29733 (interface=vboxnet0, host=192.168.56.101)
2017-10-02 17:04:03,583 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer
2017-10-02 17:04:03,680 [cuckoo.machinery.virtualbox] DEBUG: Starting vm cuckoo1
2017-10-02 17:04:03,904 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine cuckoo1 to its current snapshot
2017-10-02 17:04:13,924 [cuckoo.core.guest] INFO: Starting analysis on guest (id=cuckoo1, ip=192.168.56.101)
2017-10-02 17:04:14,939 [cuckoo.core.guest] DEBUG: cuckoo1: not ready yet
2017-10-02 17:04:15,946 [cuckoo.core.guest] DEBUG: cuckoo1: not ready yet
2017-10-02 17:04:16,959 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.7 (id=cuckoo1, ip=192.168.56.101)
2017-10-02 17:04:17,012 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=cuckoo1, ip=192.168.56.101, monitor=latest, size=30538)
2017-10-02 17:04:17,053 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2017-10-02 17:05:00,412 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label cuckoo1 to path /home/mario/.cuckoo/storage/analyses/6/memory.dmp
2017-10-02 17:05:00,413 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm cuckoo1
2017-10-02 17:05:23,206 [cuckoo.core.scheduler] ERROR: Failure in AnalysisManager.run
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/scheduler.py", line 698, in run
    self.launch_analysis()
  File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/scheduler.py", line 499, in launch_analysis
    self.guest_manage(options)
  File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/scheduler.py", line 394, in guest_manage
    self.guest_manager.start_analysis(options, monitor)
  File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/guest.py", line 465, in start_analysis
    self.upload_analyzer(monitor)
  File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/guest.py", line 372, in upload_analyzer
    self.determine_analyzer_path()
  File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/guest.py", line 350, in determine_analyzer_path
    r = self.post("/mkdtemp", data={"dirpath": systemdrive})
  File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/guest.py", line 311, in post
    r = session.post(url, *args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 535, in post
    return self.request('POST', url, data=data, json=json, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 488, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 609, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 473, in send
    raise ConnectionError(err, request=request)
ConnectionError: ('Connection aborted.', BadStatusLine("''",))
ghost commented 6 years ago

I'm also having this issue when trying to use an AVD. Did you managed to solve this issue or does it still persist?

ramirez3805 commented 6 years ago

Issue still persists for me.

ghost commented 6 years ago

I actually managed to solve this specific issue by doing some trial and error on de configuration. For me my settings are as follows:

avd.conf

cuckoo.conf

[resultserver]

From this, I was able to throw the emulator automatically after submitting the APK to be analyzed. Now I'm getting [cuckoo.core.guest] DEBUG: cuckoo3: not ready yet . I then realized that my emulator is not actually rooted with Xposed package properly installed. From my perspective, this problem might come from the emulator problem or the IP's themselves as the cuckoo itself is not able to connect to the emulator. I've turned avd mode to gui in order to get a visual status of whats' happening and from what I've seen it doesn't even install the app. Also, I'm able to throw x86 emulators but when I switch to an ARM architecture the emulator simply doesn't start (I think I have some sort of problem with my images and AVD path) This being said, don't take my settings as correct, I'm not getting the old error but it still doesn't work.

Just wanted to share my progress as it may help you overcome the ConnectionError.

ramirez3805 commented 6 years ago

Thanks for sharing your progress but I'm still having this issue and I am not doing any Android analysis if anyone from the Cuckoo team is around to help, been patiently waiting. Thanks.

daanfs commented 6 years ago

@ramirez3805: 2.0.4 is the first linux version that uses the new agent.py file (the same one as for windows analysis). Are you using the new version (0.7) inside your VM?

Can you query it from outside like so?

$ curl 192.168.56.101:8000
{"message": "Cuckoo Agent!", "version": "0.7", "features": ["execpy", "pinning", "logs", "largefile", "unicodepath"]}
ramirez3805 commented 6 years ago

Hi, thanks for responding. This is my output. {"message": "Cuckoo Agent!", "version": "0.7", "features": ["execpy", "pinning", "logs", "largefile", "unicodepath"]}

nancychuang commented 6 years ago

Hi @ramirez3805 , I have exactly the same error as you, and i finally solve it running agent in linux guest VM by root, and it works. It seems the agent is trying to create a folder for analyzer but lack of permission. Hope it also works for you. :-)

daanfs commented 6 years ago

@ramirez3805: this can happen if the agent fails to create the analyzer directory. Is agent.py running as root inside your guest?

By default it will create a directory in / for the analyzer, maybe we should change this to /tmp/.

daanfs commented 6 years ago

Seems nancychuang beat me to this answer :)

ramirez3805 commented 6 years ago

You guys are absolutely correct! That was the issue! Thank you guys so much!