search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.55k stars 1.71k forks source link

Cuckoo Sandbox produces few results #2555

Open nbshenxm opened 5 years ago

nbshenxm commented 5 years ago

My issue is: When I submit a file for analysis, Cuckoo Sandbox returns few result: some static analysis results and nearly no behavior analysis results. I looked at analyzer log and found this line: "2018-11-13 08:30:26,937 [modules.auxiliary.stap] WARNING: Exception killing stap: 'NoneType' object has no attribute 'poll". The complete analyzer log can be found below. How should I solve this problem?

My Cuckoo version and operating system are: Cuckoo 2.0.6 Host: Ubuntu 16.04 Guest: Ubuntu 14.04

Analyzer Log: 2018-11-13 08:30:24,095 [root] DEBUG: Starting analyzer from: /tmp6bhaqd 2018-11-13 08:30:24,143 [root] DEBUG: Storing results at: /tmp/WJfIvHp 2018-11-13 08:30:24,505 [modules.auxiliary.stap] WARNING: Could not find STAP LKM, aborting systemtap analysis. 2018-11-13 08:30:24,516 [root] DEBUG: Started auxiliary module STAP 2018-11-13 08:30:24,817 [root] INFO: Added new process to list with pid: 6869 2018-11-13 08:30:25,917 [root] INFO: Process with pid 6869 has terminated 2018-11-13 08:30:25,924 [root] INFO: Process list is empty, terminating analysis. 2018-11-13 08:30:26,937 [modules.auxiliary.stap] WARNING: Exception killing stap: 'NoneType' object has no attribute 'poll' 2018-11-13 08:30:26,946 [root] INFO: Analysis completed.

doomedraven commented 5 years ago

did you read the documentation? guest should be >17.04

nbshenxm commented 5 years ago

Oh, maybe I missed that part. Let me try it on a new Guest again. Thank you for answering so quickly!

doomedraven commented 5 years ago

https://github.com/cuckoosandbox/cuckoo/blob/master/docs/book/installation/guest/linux.rst :)

nbshenxm commented 5 years ago

Hello,

So I followed the instructions on the webpage you gave to setup my Guest on Ubuntu 18.04. When I was trying to install kernel debugging symbols, I have the following error:

Reading package lists. . . Done Building dependency tree Reading state information. . . Done E: Unable to locate package linux-image-4.15.0-29-generic-dbgsym E: Couldn't find any package by glob 'linux-image-4.15.0-29-generic-dbgsym' E: Couldn't find any package by regex 'linux-image-4.15.0-29-generic-dbgsym'

What should I do?

doomedraven commented 5 years ago

Google it

El jue., 22 nov. 2018 5:35, Xiangmin Shen notifications@github.com escribió:

Hello,

So I followed the instructions on the webpage you gave to setup my Guest on Ubuntu 18.04. When I was trying to install kernel debugging symbols, I have the following error:

Reading package lists. . . Done Building dependency tree Reading state information. . . Done E: Unable to locate package linux-image-4.15.0-29-generic-dbgsym E: Couldn't find any package by glob 'linux-image-4.15.0-29-generic-dbgsym' E: Couldn't find any package by regex 'linux-image-4.15.0-29-generic-dbgsym'

What should I do?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/cuckoosandbox/cuckoo/issues/2555#issuecomment-440910335, or mute the thread https://github.com/notifications/unsubscribe-auth/ABxT71RwqK27Y-BSS2doO6ZfcWMy3wLWks5uximkgaJpZM4YcDc4 .

nbshenxm commented 5 years ago

Thank you for your polite and informative reply. I managed to configure the Linux guest following the link you gave (https://github.com/cuckoosandbox/cuckoo/blob/master/docs/book/installation/guest/linux.rst). However, the analyses are consistently giving scores of 0.0 for all .ELF malwares I submit. Do you have any suggestions?

doomedraven commented 5 years ago

There is no signatures for linux you need to write them by yourself

firmianay commented 4 years ago

Hi. I use a 18.04 as both the guest and the host, but got the same error. Is there any version requirement for systemtap or kernel?