Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
DRAKVUF Sandbox : Automated Hypervisor-Level Malware Analysis System

DRAKVUF Sandbox is an automated black-box malware analysis system with DRAKVUF engine under the hood, which does not require an agent on guest OS.

This project provides you with a friendly web interface that allows you to upload suspicious files to be analyzed. Once the sandboxing job is finished, you can explore the analysis result through the mentioned interface and get an insight on whether the file is truly malicious or not.

Because it is usually pretty hard to set up a malware sandbox, this project also provides you with an installer app that would guide you through the necessary steps and configure your system using settings that are recommended for beginners. At the same time, experienced users can tweak some settings or even replace some infrastructure parts to better suit their needs. Supported hardware & softwareIn order to run DRAKVUF Sandbox, your setup must fullfill all of the listed requirements:

* Processor: Intel processor with VT-x and EPT features (how to check).
* Host system: Debian 10 Buster/Ubuntu 18.04 Bionic/Ubuntu 20.04 Focal with at least 2 core CPU and 5 GB RAM, running GRUB as bootloader.
* Guest system: Windows 7 (x64), Windows 10 (x64; experimental support)

Nested virtualization:

* KVM does work, however it is considered experimental. If you experience any bugs, please report them to us for further investigation.
* Due to lack of exposed CPU features, hosting DRAKVUF Sandbox in the cloud is not supported (although it might change in the future).
* Hyper-V does not work.
* Xen does work out of the box.
* VMware Workstation Player does work, but you need to check Virtualize EPT option for a VM; Intel processor with EPT still required. Basic installationThis instruction assumes that you want to create a single-node installation with the default components, which is recommended for beginners.

* Download latest release packages.
* Install DRAKVUF:

# apt update
# apt install ./drakvuf-bundle*.deb
# reboot

* Install DRAKVUF Sandbox stack:

apt install redis-server
apt install ./drakcore.deb apt install ./drakrun.deb

* Check if your Xen installation is compliant. This command should print “All tests passed”:

draksetup test

Execute:

draksetup install /opt/path_to_windows.iso

Read the command’s output carefully. This command will run a virtual machine with Windows system installation process.

Customize vCPUs/memory: You can pass additional options in order to customize number of vCPUs (--vcpus ) and amount of memory (--memory ) per single VM. For instance: --vcpus 1 --memory 2048.

Recommended minimal values that are known to work properly with DRAKVUF Sandbox:
System versionMinimal vCPUsMinimal RAMWindows 711536Windows 1023072
Unattended installation: If you have autounattend.xmlmatching your Windows ISO, you can request unattended installation by adding --unattended-xml /path/to/autounattend.xml. Unattended install configuration can be generated with Windows Answer File Generator.

Use VNC to connect to the installation process:

vncviewer localhost:5900

* Perform Windows installation until you are booted to the desktop.
* Optional: At this point you might optionally install additional software. You can execute:
draksetup mount /path/to/some-cd.iso
* which would mount a virtual CD disk containing additional software into your VM.
* Optional: Generate .NET Framework native image cache by executing the following commands in the administrative prompt of your VM.
cd C:\Windows\Microsoft.NET\Framework\v4.0.30319
ngen.exe executeQueuedItems cd C:\Windows\Microsoft.NET\Framework64\v4.0.30319
ngen.exe executeQueuedItems
In order to finalize the VM setup process, exe[...]

___________________________
@hacking_Attack
@Hacking_Video