Open Source Malware Lab

Explore the world of open source malware analysis tools in this comprehensive 50-minute conference talk from Security BSides London. Dive into the essential components of a malware analysis lab, focusing on four main entry points: files, URLs, network traffic captures, and memory images. Learn about major open source tools for each entry point, including Cuckoo Sandbox for file analysis, Thug for URL analysis, Bro Network Security Monitor for network capture analysis, and the Volatility Framework for memory image analysis. Discover how to link these tools together to create an automated, comprehensive malware analysis lab. Gain insights into tool inputs, outputs, and potential automation techniques to enhance your malware analysis capabilities.

Intro
Why Do I Need A Malware Analysis Lab?
Malware Analysis Process Entry Points
Open Source Malware Analysis Tools
More Than Just Dynamic Analysis
Cuckoo Modified
Cuckoo Output
Wolf in Sheep's Clothing
Thug Output
Extracted Files
What is the Volatility Framework?
Operating System Support
Volatility Outout
Orchestration and Automation