spender-sandbox / cuckoo-modified

Modified edition of cuckoo
392 stars 178 forks source link

What we will lose if we don't have internet on cuckoo system #496

Open masifpak80 opened 6 years ago

masifpak80 commented 6 years ago

We have an environment where we don't have internet. I wan to know, can our cuckoo-modified can provide network communication which it DNS servers. What lose we will face?

doomedraven commented 6 years ago

ROFL, all depends of the malware which you analyze, if malware is just a downloaded, you will lose payload, if malware do check for internet connection before detonate, you will lose it, I think you got the idea ;)

masifpak80 commented 6 years ago

We are a financial organization. We can not give open internet access to our Cuckoo machine. What site you think should allow for cuckoo by proxy to get maximum malware payload and traces. Please guide me regarding these understandings, what is ROFL? When a malware is download, payload is not its part? I mean why it need internet for payload?

doomedraven commented 6 years ago

what you need is learn what is malware and how different malware families/types work to better understand what you really need and what you will lose without internet.

you can fake internet with inetsim, but is kinda the same as no internet

I mean why it need internet for payload?

is like if you want to see video on youtube, why do you need internet ? real example i hope will explain better