kevoreilly / CAPEv2

Malware Configuration And Payload Extraction
https://capesandbox.com/analysis/
Other
1.97k stars 421 forks source link

Linux guest analysis #2136

Closed MU-03 closed 5 months ago

MU-03 commented 5 months ago

About accounts on capesandbox.com

This is open source and you are getting free support so be friendly!

Prerequisites

Please answer the following questions for yourself before submitting an issue.

Expected Behavior

Complete analysis in linux guest machine with screen shots of analysis

Current Behavior

I am getting 0.6 malscore for all the bash scripts im analyzing , its giving very limited network analysis , and not analyzing elf files.

Failure Information (for bugs)

Steps to Reproduce

The following steps were given in the documentation: $ sudo dpkg --add-architecture i386 $ sudo apt update $ sudo apt install python3:i386 -y $ sudo apt install python3-distutils -y $ sudo apt install systemtap-runtime -y $ curl -sSL https://bootstrap.pypa.io/get-pip.py -o get-pip.py $ python3 get-pip.py $ python3 -m pip install pyinotify $ python3 -m pip install Pillow # optional $ python3 -m pip install pyscreenshot # optional $ python3 -m pip install pyautogui # optional I did not added 32 bit architecture because it lead to loss of GUI , terminal etc ,and as its not crucial for ubuntu analysis, I used 64 bit python 3.8.10 and installed all the above dependencies. Also diabled firewall ,NTP etc

Context

Please provide any relevant information about your setup. This is important in case the issue is not reproducible except for under certain conditions. Operating system version, bitness, installed software versions, test sample details/hash/binary (if applicable).

Question Answer
Git commit Type $ git log \| head -n1 to find out
OS version Ubuntu 22.04
Guest OS Ubuntu 20.04

Failure Logs

Please include any relevant log snippets or files here.

doomedraven commented 5 months ago

Malscore is useless feature

El vie, 24 may 2024, 12:13, MU-03 @.***> escribió:

About accounts on capesandbox.com

This is open source and you are getting free support so be friendly! Prerequisites

Please answer the following questions for yourself before submitting an issue.

  • [Y] I am running the latest version
  • [Y] I did read the README!
  • [Y] I checked the documentation and found no answer
  • [Y] I checked to make sure that this issue has not already been filed
  • [Y] I'm reporting the issue to the correct repository (for multi-repository projects)
  • [Y] I have read and checked all configs (with all optional parts)

Expected Behavior

Complete analysis in linux guest machine with screen shots of analysis Current Behavior

I am getting 0.6 malscore for all the bash scripts im analyzing , its giving very limited network analysis , and not analyzing elf files. Failure Information (for bugs) Steps to Reproduce

The following steps were given in the documentation: $ sudo dpkg --add-architecture i386 $ sudo apt update $ sudo apt install python3:i386 -y $ sudo apt install python3-distutils -y $ sudo apt install systemtap-runtime -y $ curl -sSL https://bootstrap.pypa.io/get-pip.py -o get-pip.py $ python3 get-pip.py $ python3 -m pip install pyinotify $ python3 -m pip install Pillow # optional $ python3 -m pip install pyscreenshot # optional $ python3 -m pip install pyautogui # optional I did not added 32 bit architecture because it lead to loss of GUI , terminal etc ,and as its not crucial for ubuntu analysis, I used 64 bit python 3.8.10 and installed all the above dependencies. Also diabled firewall ,NTP etc Context

Please provide any relevant information about your setup. This is important in case the issue is not reproducible except for under certain conditions. Operating system version, bitness, installed software versions, test sample details/hash/binary (if applicable). Question Answer Git commit Type $ git log | head -n1 to find out OS version Ubuntu 22.04 Guest OS Ubuntu 20.04 Failure Logs

Please include any relevant log snippets or files here.

— Reply to this email directly, view it on GitHub https://github.com/kevoreilly/CAPEv2/issues/2136, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAOFH32JRVEVVVJBWIVIVKTZD4HCZAVCNFSM6AAAAABIHJFXB6VHI2DSMVQWIX3LMV43ASLTON2WKOZSGMYTKMBRGY3DGMA . You are receiving this because you are subscribed to this thread.Message ID: @.***>

MU-03 commented 5 months ago

Regardless of malscore , im getting same result for all the files im submitting, exactly same network activity and limited signatures , is there any dependency im missing in the guest OS?

doomedraven commented 5 months ago

no, there is lack of linux signatures, CAPE is windows focused sandbox, and community writes windows focused signatures more than linux