Installing cuckoo sandbox in backtrack for malware analysis

  20 Responses to “Installing cuckoo sandbox in backtrack for malware analysis”

1. 

   henryflynn2 says:

   December 30, 2012 at 1:52 pm

   Hi

   Working through this config. I have a problem with the cuckoo.conf. The .conf file as included in the latest 0.5 cuckoo build does not have a [Virtual Machines] section..

   Its just that this article implies it will already be there just to be edited.

   hope you can help.

   henry

   Log in to Reply
   • 

     edwigetadmin says:

     December 30, 2012 at 2:11 pm

     This is what I have for mine….

     http://www.cuckoobox.org
     #
     # This file is part of Cuckoo.
     #
     # Cuckoo is free software: you can redistribute it and/or modify
     # it under the terms of the GNU General Public License as published by
     # the Free Software Foundation, either version 3 of the License, or
     # (at your option) any later version.
     #
     # Cuckoo is distributed in the hope that it will be useful,
     # but WITHOUT ANY WARRANTY; without even the implied warranty of
     # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
     # GNU General Public License for more details.
     #
     # You should have received a copy of the GNU General Public License
     # along with this program. If not, see http://www.gnu.org/licenses/.

     [Logging]
     # Enable/Disable additional debugging messages. This messages won’t wrote to
     # log file but just printed on screen. [on/off]
     debug = off

     [Analysis]
     # This is the actual analysis timeout (expressed in seconds). This represents
     # the default timeout performed by analysis core if none is specified.
     analysis_timeout = 1200
     # Watchdog timeout (expressed in seconds) for analysis execution to complete,
     # when this timeout gets hit, current execution is aborted and virtual machine
     # is restored and freed.
     watchdog_timeout = 1800
     # Specify here the path where analysis results shall be stored.
     results_path = analysis/
     # Enable or disable this option to instruct Cuckoo to delete the original file
     # submitted for the analysis. [on/off]
     delete_file = off

     [Processing]
     # Specify here the interpreter path to be used to launch the script.
     interpreter = /usr/bin/python
     # Specify here the path to the analysis results processing script.
     script = processor.py

     [Sniffer]
     # Enable or disable the following option by assigning a True or False value.
     # In case you decide to disable it, you’re supposed to either not have any
     # network dump or to used VirtualBox’s (or any other virtualization engine
     # you are using) to handle the network monitoring instead of using an external
     # sniffer such as tcpdump. [on/off]
     sniffer = on
     # Path to the sniffer (tcpdump) binary.
     path = /usr/sbin/tcpdump
     # This specifies the network interface where the sniffer will bind to in order
     # to monitor virtual machines’ generated traffic.
     interface = eth0

     [VirtualMachines]
     # Virtualization product.
     engine = VirtualBox
     # List virtual machines IDs separated by commas.
     enabled = cuckoo1
     # Set to “gui” if you want Cuckoo to spawn virtual machines’ GUIs or set to
     # “headless” if you don’t.
     mode = gui
     # Path to local Python installation on guest machines. Please be sure to have
     # correctly set this value as it’s critical to Cuckoo’s proper execution.
     python = C:\Python27\python.exe

     [cuckoo1]
     name = cuckoo1
     username = MYUSERNAME
     password = MYPASSWORD
     # Please notice that the shared folder name must coincide with the current
     # virtual machine id, which is the name you assigned between the square
     # brackets (e.g. [cuckoo1]).
     share = shares/cuckoo1

     [cuckoo2]
     name = cuckoo2
     username = MYUSERNAME
     password = MYPASSWORD
     # Please notice that the shared folder name must coincide with the current
     # virtual machine id, which is the name you assigned between the square
     # brackets (e.g. [cuckoo1]).
     share = shares/cuckoo2
     “

     Log in to Reply
     • 

       henryflynn2 says:

       December 30, 2012 at 3:11 pm

       Hi

       Thanks much for getting back to me.

       I will follow the same syntax and layout and give it a try again!

       Regards

       Henry

       Log in to Reply
       • 

         edwigetadmin says:

         December 30, 2012 at 3:22 pm

         not a problem at all……I haven’t updated to the latest version yet so let me know if it doesn’t work and I will update so I can see where the problem is.

         Log in to Reply
         • 

           henryflynn2 says:

           December 30, 2012 at 5:26 pm

           Hi

           As a matter of interest – below is the contents of the new 0.5 version cuckoo.conf file. I’m getting “CuckooCriticalError: Configured machine cuckoo1 was not detected or its not in proper state” – I would bet its down to the conf file. The article stated section “[Virtual Machines]” is not present…

           ” [cuckoo]
           # Enable or disable startup version check. When enabled, Cuckoo will connect
           # to a remote location to verify whether the running version is the latest
           # one available.
           version_check = on

           # If turned on, Cuckoo will delete the original file and will just store a
           # copy in the local binaries repository.
           delete_original = off

           # Specify the name of the machine manager module to use, this module will
           # define the interaction between Cuckoo and your virtualization software
           # of choice.
           machine_manager = virtualbox

           # Enable creation of memory dump of the analysis machine before shutting
           # down. Even if turned off, this functionality can also be enabled at
           # submission. Currently available for: VirtualBox and libvirt modules (KVM).
           memory_dump = off

           [processing]
           # Set the maximum size of analysis’s generated files to process.
           # This is used to avoid the processing of big files which can bring memory leak.
           # The value is expressed in bytes, by default 100Mb.
           analysis_size_limit = 104857600

           # Enable or disable DNS lookups.
           resolve_dns = on

           [database]
           # Specify the database connection string.
           # Examples, see documentation for more:
           # sqlite:///foo.db
           # postgresql://foo:bar@localhost:5432/mydatabase
           # mysql://foo:bar@localhost/mydatabase
           # If empty, default is a SQLite in db/cuckoo.db.
           connection =

           # Database connection timeout in seconds.
           # If empty, default is set to 60 seconds.
           timeout =

           [timeouts]
           # Set the default analysis timeout expressed in seconds. This value will be
           # used to define after how many seconds the analysis will terminate unless
           # otherwise specified at submission.
           default = 120

           # Set the critical timeout expressed in seconds. After this timeout is hit
           # Cuckoo will consider the analysis failed and it will shutdown the machine
           # no matter what. When this happens the analysis results will most likely
           # be lost. Make sure to have a critical timeout greater than the
           # default timeout.
           critical = 600

           # Maximum time to wait for virtual machine status change. For example when
           # shutting down a vm. Default is 300 seconds.
           vm_state = 300

           [sniffer]
           # Enable or disable the use of an external sniffer (tcpdump) [yes/no].
           enabled = yes

           # Specify the path to your local installation of tcpdump. Make sure this
           # path is correct.
           tcpdump = /usr/sbin/tcpdump

           # Specify the network interface name on which tcpdump should monitor the
           # traffic. Make sure the interface is active.
           interface = vboxnet0

           [graylog]
           # Enable or disable remote logging to a Graylog2 server.
           enabled = no

           # Graylog2 server host.
           host = localhost

           # Graylog2 server port.
           port = 12201

           # Default logging level for Graylog2. [debug/info/error/critical].
           level = error
           ”

           I will keep it simple and try set up a single machine called cuckoo1 using some of your conf file lines.

           Regards

           Henry
         • 

           Jeremy says:

           September 17, 2013 at 3:23 pm

           Did you ever find a resolution for this error? I am coming across the same error.

           Jeremy
2. 

   henryflynn2 says:

   December 30, 2012 at 5:41 pm

   Hi again – looking at this further – it appears considerably different -perhaps I should have installed the atricle version (0.3.3-dev) first! There is a virtualbox.conf where the user configures the virtual machine(s) as opposed to in the cuckoo.conf.

   Maybe Ive bitten off more than I bargained for..

   Henry

   Log in to Reply
3. 

   insanlaksana says:

   February 19, 2013 at 8:10 pm

   hi, i’m trying to install Cuckoo sandbox follow your instruction. but i’m try it on ubuntu 12.04.
   but when i try ./submit.py –url http://maliciousurl.tld/exploit.php, i’ve got error :

   [2013-02-20 06:58:05,883] [Core.Init] INFO: Started.
   [2013-02-20 06:58:05,929] [VirtualMachine.Check] INFO: Your VirtualBox version is: “4.2.0”, good!
   [2013-02-20 06:58:05,930] [Core.Init] INFO: Populating virtual machines pool…
   [2013-02-20 06:58:06,424] [VirtualMachine.Restore] INFO: Virtual machine “cuckoo1” successfully restored to current snapshot.
   [2013-02-20 06:58:06,432] [VirtualMachine.Infos] INFO: Virtual machine “cuckoo1” information:
   [2013-02-20 06:58:06,433] [VirtualMachine.Infos] INFO: \_| Name: cuckoo1
   [2013-02-20 06:58:06,434] [VirtualMachine.Infos] INFO: | ID: ff0ae5e5-702e-4301-bce3-2b70bf9d230a
   [2013-02-20 06:58:06,434] [VirtualMachine.Infos] INFO: | CPU Count: 1 Core/s
   [2013-02-20 06:58:06,434] [VirtualMachine.Infos] INFO: | Memory Size: 256 MB
   [2013-02-20 06:58:06,435] [VirtualMachine.Infos] INFO: | VRAM Size: 16 MB
   [2013-02-20 06:58:06,435] [VirtualMachine.Infos] INFO: | State: Saved
   [2013-02-20 06:58:06,435] [VirtualMachine.Infos] INFO: | Current Snapshot: ““baseImage””
   [2013-02-20 06:58:06,436] [VirtualMachine.Infos] INFO: | MAC Address: 08:00:27:4C:57:E6
   [2013-02-20 06:58:06,436] [Core.Init] INFO: 1 virtual machine/s added to pool.
   [2013-02-20 06:58:06,450] [Core.Dispatcher] INFO: Acquired analysis task for target “/tmp/887645fa9577b5fd0501793e016ab245.url”.
   [2013-02-20 06:58:06,694] (Task #6) [Core.Analysis.Run] INFO: Acquired virtual machine “cuckoo1”.
   [2013-02-20 06:58:06,702] [Sniffer.Start] INFO: Sniffer started monitoring 08:00:27:4C:57:E6.
   tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 1515 bytes
   [2013-02-20 06:58:07,247] [VirtualMachine.Restore] INFO: Virtual machine “cuckoo1” successfully restored to current snapshot.
   [2013-02-20 06:58:12,492] [VirtualMachine.Start] INFO: Virtual machine “cuckoo1” starting in “gui” mode.
   Exception in thread 6:
   Traceback (most recent call last):
   File “/usr/lib/python2.7/threading.py”, line 551, in __bootstrap_inner
   self.run()
   File “./cuckoo.py”, line 524, in run
   if not vm.execute(python_path, args):
   File “/opt/cuckoo/cuckoo/core/virtualbox.py”, line 355, in execute
   exec_flags = VBOX.ExecuteProcessFlag_Hidden #
   File “/usr/local/lib/python2.7/dist-packages/vboxapi/VirtualBox_constants.py”, line 1266, in __getattr__
   raise AttributeError
   AttributeError

   any ideas?
   i don’t have any clue…
   thanks.

   Log in to Reply
   • 

     CISSP says:

     April 1, 2013 at 6:39 am

     i have got the same question to you.

     yijiedao@ubuntu:~/software/cuckoo-1$ python cuckoo.py
     _
     ____ _ _ ____| | _ ___ ___
     / ___) | | |/ ___) |_/ ) _ \ / _ \
     ( (___| |_| ( (___| _ ( |_| | |_| |
     \____)____/ \____)_| \_)___/ \___/ v0.3.2

     http://www.cuckoobox.org
     Copyright (C) 2010-2012

     [2013-04-01 18:08:34,308] [Core.Init] INFO: Started.
     [2013-04-01 18:08:34,557] [VirtualMachine.Check] INFO: Your VirtualBox version is: “4.2.10”, good!
     [2013-04-01 18:08:34,558] [Core.Init] INFO: Populating virtual machines pool…
     [2013-04-01 18:08:35,324] [VirtualMachine.Restore] INFO: Virtual machine “cuckoo1” successfully restored to current snapshot.
     [2013-04-01 18:08:35,331] [VirtualMachine.Infos] INFO: Virtual machine “cuckoo1” information:
     [2013-04-01 18:08:35,331] [VirtualMachine.Infos] INFO: \_| Name: cuckoo1
     [2013-04-01 18:08:35,331] [VirtualMachine.Infos] INFO: | ID: 7802e5d8-fbbc-472e-aa68-db7359ff18ab
     [2013-04-01 18:08:35,331] [VirtualMachine.Infos] INFO: | CPU Count: 1 Core/s
     [2013-04-01 18:08:35,332] [VirtualMachine.Infos] INFO: | Memory Size: 256 MB
     [2013-04-01 18:08:35,332] [VirtualMachine.Infos] INFO: | VRAM Size: 16 MB
     [2013-04-01 18:08:35,332] [VirtualMachine.Infos] INFO: | State: Saved
     [2013-04-01 18:08:35,332] [VirtualMachine.Infos] INFO: | Current Snapshot: “admin-04-01”
     [2013-04-01 18:08:35,332] [VirtualMachine.Infos] INFO: | MAC Address: 08:00:27:B9:AF:A9
     [2013-04-01 18:08:35,333] [Core.Init] INFO: 1 virtual machine/s added to pool.
     [2013-04-01 18:08:35,333] [Core.Dispatcher] INFO: Acquired analysis task for target “/home/yijiedao/software/virus-sample/vir12/vir12-9-29/12-9-29/001gangsir.cn.exe”.
     [2013-04-01 18:08:35,696] (Task #4) [Core.Analysis.Run] INFO: Acquired virtual machine “cuckoo1”.
     [2013-04-01 18:08:35,723] [Sniffer.Start] INFO: Sniffer started monitoring 08:00:27:B9:AF:A9.
     tcpdump: eth0: You don’t have permission to capture on that device
     (socket: Operation not permitted)
     [2013-04-01 18:08:36,571] [VirtualMachine.Restore] INFO: Virtual machine “cuckoo1” successfully restored to current snapshot.
     [2013-04-01 18:08:41,554] [VirtualMachine.Start] INFO: Virtual machine “cuckoo1” starting in “gui” mode.
     Exception in thread 4:
     Traceback (most recent call last):
     File “/usr/lib/python2.7/threading.py”, line 551, in __bootstrap_inner
     self.run()
     File “cuckoo.py”, line 524, in run
     if not vm.execute(python_path, args):
     File “/home/yijiedao/software/cuckoo-1/cuckoo/core/virtualbox.py”, line 355, in execute
     exec_flags = VBOX.ExecuteProcessFlag_Hidden #
     File “/usr/local/lib/python2.7/dist-packages/vboxapi/VirtualBox_constants.py”, line 1266, in __getattr__
     raise AttributeError
     AttributeError

     have you ever solved this problem?
     please give me some help

     Log in to Reply
     • 

       edwigetadmin says:

       April 1, 2013 at 9:18 am

       One of the things I noticed is that it says you don’t have permisions to capture tcpdump. I would validate your installation and check permissions.

       tcpdump: eth0: You don’t have permission to capture on that device

       Also, check the path of your python installation in the virtual machine and make sure it matches the settings.

       Log in to Reply
       • 

         CISSP says:

         April 2, 2013 at 5:16 am

         i have rechecked the installation steps and i found that i forget to setup the “tcpdump” properly,right now ,the tcpdump can listen the eth0 :

         tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 1515 bytes

         but the problem i posted is still here bothering me ：

         Traceback (most recent call last):
         File “/usr/lib/python2.7/threading.py”, line 551, in __bootstrap_inner
         self.run()
         File “cuckoo.py”, line 524, in run
         if not vm.execute(python_path, args):
         File “/home/yijiedao/software/cuckoo-1/cuckoo/core/virtualbox.py”, line 355, in execute
         exec_flags = VBOX.ExecuteProcessFlag_Hidden #
         File “/usr/local/lib/python2.7/dist-packages/vboxapi/VirtualBox_constants.py”, line 1266, in __getattr__
         raise AttributeError
         AttributeError

         i installed Virtualbox-4.2.10 for ubuntu 12.04 LTS on the ubuntu host,and a windows xp SP3 as a guest machine running the cuckoo sandbox-0.3.2,Python-2.7.3 is installed in the ubuntu host by default.
         i installed python-3.2myself,does these two versions of python collide each other raise the problem up there?
         so i uninstalled the python-3.2 with command:

         $ sudo apt-get –purge remove python3.2
         $ sudo apt-get autoremove

         when runing the cuckoo vm,the problem still come out
         what should i do ? this one have bothered me for almost three days !

         Log in to Reply
4. Analyser un logiciel malveillant comme un nul(l) 1/2 | Pirater comme un nul(l) says:

   March 31, 2013 at 12:42 pm

   […] http://www.edwiget.name/2012/07/installing-cuckoo-sandbox-in-backtrack-for-malware-analysis/ […]
5. 

   Jeremy says:

   September 12, 2013 at 2:26 pm

   I am new to the Cuckoo Sandbox, but I have been following this article for building a sandbox. When I get to the starting of Cuckoo (./cuckoo.py) I get the following error:

   [root] CRITICAL: CuckooCriticalError: Unable to bind result server on 192.168.56.1:2042: [Errorno 99] Cannot assign requested address

   Is this a VirtualBox related issue?

   Log in to Reply
   • 

     edwigetadmin says:

     September 12, 2013 at 2:58 pm

     is that running as the root user? If I was to guess from the message alone, I would say either a permissions issue or firewall issue. BTW, I haven’t actually used cuckoo in some time myself and several people have stated the instructions dont seem to work for the newer versions of cuckoo.

     Log in to Reply
     • 

       Jeremy says:

       September 12, 2013 at 4:39 pm

       Was able to get the vboxnet0 worked out. I just needed to add it in VirutalBox, thought that it was not seeing it, however clicking on the add button in Preferences/Network did the trick. Now the issue is: Configured machine cuckoo1 was not detected or it’s not in proper state.

       I believe the issue is that it is looking for cuckoo1, I named mine “Cuckoo1x64”. How do I edit this to see “Cuckoo1x64” and not cuckoo1?

       Log in to Reply
   • 

     ysudhirk says:

     July 2, 2014 at 2:58 am

     No wat u have to do is open virtualmachine and execute cuckoo.py u won’t find this error

     Log in to Reply
6. 

   Jeremy says:

   September 17, 2013 at 1:00 pm

   I’m to the point that I am receiving the error: “CuckooCriticalError: Configured machine cuckoo1 was not detected or it’s not in proper state”. I went through the conf and changed all names to “Cuckoo1x64”, does it matter if the name isn’t “cuckoo1”? Does it need to be “cuckoo1” for the sake of the program?

   Jeremy

   Log in to Reply
7. 

   ysudhirk says:

   July 2, 2014 at 3:17 am

   My cuckoo executing well but for only some kind of files.For the rest i am getiing the following error. I think there is a problem with processing modules dropped and tagetinfo.But i am not fin it can any body help.

   Checking for updates…
   Outdated! Cuckoo Sandbox version 1.1 is available now.

   2014-07-02 12:31:59,524 [lib.cuckoo.core.scheduler] INFO: Using “virtualbox” machine manager
   2014-07-02 12:32:01,210 [lib.cuckoo.core.scheduler] INFO: Loaded 1 machine/s
   2014-07-02 12:32:01,211 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks…
   2014-07-02 12:32:51,200 [lib.cuckoo.core.scheduler] INFO: Starting analysis of FILE “/home/vamz/Downloads/cuckoo_exe/new/TeamViewer_Setup_en.exe” (task=767)
   2014-07-02 12:32:51,354 [lib.cuckoo.core.scheduler] INFO: File already exists at “/home/vamz/cuckoo/storage/binaries/183a3f0822d661909bca09997d0d2caee440bfc385a9252185f6adf72b5e12f3”
   2014-07-02 12:32:51,418 [lib.cuckoo.core.scheduler] INFO: Task #767: acquired machine WinXPVM1 (label=WinXPVM1)
   2014-07-02 12:32:51,452 [modules.auxiliary.sniffer] INFO: Started sniffer with PID 3669 (interface=vboxnet0, host=192.168.56.101, dump path=/home/vamz/cuckoo/storage/analyses/767/dump.pcap)
   2014-07-02 12:32:55,770 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=WinXPVM1, ip=192.168.56.101)
   2014-07-02 12:35:07,445 [lib.cuckoo.core.guest] INFO: WinXPVM1: analysis completed successfully
   2014-07-02 12:35:09,761 [lib.cuckoo.core.scheduler] INFO: Starting analysis of FILE “/home/vamz/Downloads/cuckoo_exe/new/pars-vpn.exe” (task=768)
   2014-07-02 12:35:10,035 [lib.cuckoo.core.plugins] ERROR: Failed to run the processing module “Dropped”:
   Traceback (most recent call last):
   File “/home/vamz/cuckoo/lib/cuckoo/core/plugins.py”, line 183, in process
   data = current.run()
   File “/home/vamz/cuckoo/modules/processing/dropped.py”, line 23, in run
   file_info = File(file_path=file_path).get_all()
   File “/home/vamz/cuckoo/lib/cuckoo/common/objects.py”, line 264, in get_all
   infos[“yara”] = self.get_yara()
   File “/home/vamz/cuckoo/lib/cuckoo/common/objects.py”, line 240, in get_yara
   except yara.Error as e:
   AttributeError: ‘module’ object has no attribute ‘Error’

   Log in to Reply
   • 

     ysudhirk says:

     July 2, 2014 at 5:41 am

     Can any one pls reply???

     Log in to Reply
8. Analyser un logiciel malveillant et Dangereux 1/2 – Le Hack pour les nuls says:

   April 4, 2017 at 4:01 pm

   […] http://www.edwiget.name/2012/07/installing-cuckoo-sandbox-in-backtrack-for-malware-analysis/ […]

This site uses Akismet to reduce spam. Learn how your comment data is processed.