Automating dynamic malware analysis
summary
Uses Cuckoo sandbox running in VMs that revert to snapshots for clean state, captures API calls, registry changes and full network traffic, and mitigates anti-VM checks by changing MACs and hypervisor fingerprints. Scales by removing a central coordinator so workers pull from per-sandbox queues, auto-clean disks and repair VMs, and store artifacts in distributed storage. CI/CD (GitHub/Jenkins) deploys updated worker code; monitoring uses ELK/Grafana/alerts and network simulation via INetSim or routed Tor/VPN for safe internet behavior.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:39Defining analysis
- 1:10Static vs dynamic analysis
- 3:04Practical model analysis
- 3:23Malware analysis software
- 4:03Sandbox architecture
- 5:01How does Sandbox work
- 6:05If your analysis works
- 6:40Anti VM techniques
- 7:25VM configuration
- 7:55Network configuration
- 10:00Services
- 10:31Distributed Analysis
- 12:05Centralized Manager
- 12:40Sandbox Queue
- 13:36Cleanup
- 14:16Automation Pipeline
- 15:45Not modular
- 16:14Deployment structure
- 17:15Questions
related talks
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
27mYomi: a real-life sandbox architecture and implementation
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
44mSlime: Automated Anti-Sandboxing Disarmament System
56mAutomating Linux Malware Analysis Using Limon Sandbox
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
25mCloud-Native Sandboxes for Microservices: Understanding New Threats and Attacks
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis