Open Nwinternights opened 6 years ago
analyzer.log Analysis set on 280 sec) Hi all, gotta a sample of a RAT that uses Autoit, I've submitted to cuckoo (2.0.4.4) and I got a really low score with few matched signatures. All the traffic were not dumped(POST to Webservers and of course Suricata Signatures) neither all the signatures regarding evasion/detection the sample is https://www.reverse.it/sample/a1a9c279c69734079b0e882ab8abfbdb6adbb637b52ec716faf3dc374a91d8c3?environmentId=100. Any help is appreciated. regards
Partial output with cuckoo 1.3
I'm seeing the same issue with the latest (git) cuckoo...only with several different malwares (ransomeware, trojan, malware).
analyzer.log Analysis set on 280 sec) Hi all, gotta a sample of a RAT that uses Autoit, I've submitted to cuckoo (2.0.4.4) and I got a really low score with few matched signatures. All the traffic were not dumped(POST to Webservers and of course Suricata Signatures) neither all the signatures regarding evasion/detection
Any help is appreciated.
regards
the sample is https://www.reverse.it/sample/a1a9c279c69734079b0e882ab8abfbdb6adbb637b52ec716faf3dc374a91d8c3?environmentId=100.
Partial output with cuckoo 1.3![1 3](https://user-images.githubusercontent.com/18212777/32893587-65d75390-cada-11e7-8b7a-906b41ca2228.PNG)