Cuckoo Sandbox — динамический анализ вредоносных программ

★ 8.4 · security

analyzing-malware-behavior-with-cuckoo-sandbox is a Claude Code skill that detonates malware samples in Cuckoo Sandbox to capture runtime behavior — process creation, file system and registry changes, network communications, and API calls — and produces structured behavioral reports for classification and IOC extraction. The skill covers the full workflow: submitting a file or URL via CLI or REST API with a configurable timeout and guest VM selection, parsing the JSON report to flag suspicious API calls such as CreateRemoteThread, WriteProcessMemory, and URLDownloadToFileA, reviewing DNS queries, HTTP requests, and TCP connections, and documenting dropped files with SHA-256 hashes alongside registry key modifications. It is intended for use after static triage when mapping a full infection chain, extracting indicators of compromise, or building YARA and behavioral signatures from sandbox activity. Designed for malware analysts and incident response teams running Cuckoo 3.x on a dedicated server with an isolated network and InetSim or FakeNet-NG for internet simulation.