performing-automated-malware-analysis-with-cape

使用 CAPE 执行自动化恶意软件分析

概述

CAPE（Config And Payload Extraction）是一个源自 Cuckoo 的开源恶意软件沙箱，可自动化执行行为分析、载荷转储和配置提取。CAPEv2 具备用于行为插桩的 API hooking，能够捕获执行期间创建/修改/删除的文件，以 PCAP 格式记录网络流量，并包含 70+ 个自定义配置提取器（cape-parsers），适用于 Emotet、TrickBot、Cobalt Strike、AsyncRAT 和 Rhadamanthys 等家族。其签名系统包含 1000+ 个行为签名，可检测规避技术、持久化、凭据窃取和勒索软件行为。CAPE 的调试器支持动态反规避绕过，将调试器操作与 YARA 签名相结合。推荐部署方式：Ubuntu LTS 主机搭配 Windows 10 21H2 来宾虚拟机。

何时使用

• 当进行涉及使用 cape 执行自动化恶意软件分析的安全评估时
• 当遵循相关安全事件的事件响应流程时
• 当执行计划内的安全测试或审计活动时
• 当通过动手测试验证安全控制措施时

前置条件

• Ubuntu 22.04 LTS 服务器（8+ CPU 核心，32GB+ 内存，500GB+ SSD）
• KVM/QEMU 虚拟化支持
• Windows 10 21H2 来宾镜像
• Python 3.9+ 及 CAPEv2 依赖项
• 用于隔离分析网络的网络配置

工作流

步骤 1：通过 API 提交并分析样本

#!/usr/bin/env python3
"""CAPE sandbox API client for automated malware submission and analysis."""
import requests
import json
import time
import sys
from pathlib import Path


class CAPEClient:
    def __init__(self, base_url="http://localhost:8000", api_token=None):
        self.base_url = base_url.rstrip("/")
        self.headers = {}
        if api_token:
            self.headers["Authorization"] = f"Token {api_token}"

    def submit_file(self, filepath, options=None):
        """Submit a file for analysis."""
        url = f"{self.base_url}/apiv2/tasks/create/file/"
        files = {"file": open(filepath, "rb")}
        data = options or {}
        data.setdefault("timeout", 120)
        data.setdefault("enforce_timeout", False)

        resp = requests.post(url, files=files, data=data, headers=self.headers)
        resp.raise_for_status()
        result = resp.json()
        task_id = result.get("data", {}).get("task_ids", [None])[0]
        print(f"[+] Submitted {filepath} -> Task ID: {task_id}")
        return task_id

    def get_status(self, task_id):
        """Check task analysis status."""
        url = f"{self.base_url}/apiv2/tasks/status/{task_id}/"
        resp = requests.get(url, headers=self.headers)
        return resp.json().get("data", "unknown")

    def wait_for_completion(self, task_id, poll_interval=15, max_wait=600):
        """Wait for analysis to complete."""
        elapsed = 0
        while elapsed < max_wait:
            status = self.get_status(task_id)
            if status == "reported":
                print(f"[+] Task {task_id} completed")
                return True
            time.sleep(poll_interval)
            elapsed += poll_interval
            print(f"  Waiting... ({elapsed}s, status: {status})")
        return False

    def get_report(self, task_id):
        """Retrieve full analysis report."""
        url = f"{self.base_url}/apiv2/tasks/get/report/{task_id}/"
        resp = requests.get(url, headers=self.headers)
        return resp.json()

    def get_config(self, task_id):
        """Get extracted malware configuration."""
        report = self.get_report(task_id)
        configs = report.get("CAPE", {}).get("configs", [])
        return configs

    def get_dropped_files(self, task_id):
        """List files dropped during analysis."""
        report = self.get_report(task_id)
        return report.get("dropped", [])

    def get_network_iocs(self, task_id):
        """Extract network IOCs from analysis."""
        report = self.get_report(task_id)
        network = report.get("network", {})
        iocs = {
            "dns": [d.get("request") for d in network.get("dns", [])],
            "http": [h.get("uri") for h in network.get("http", [])],
            "tcp": [f"{h.get('dst')}:{h.get('dport')}"
                    for h in network.get("tcp", [])],
        }
        return iocs

    def analyze_sample(self, filepath):
        """Full automated analysis pipeline."""
        task_id = self.submit_file(filepath)
        if not task_id:
            return None

        if self.wait_for_completion(task_id):
            report = {
                "task_id": task_id,
                "config": self.get_config(task_id),
                "network_iocs": self.get_network_iocs(task_id),
                "dropped_files": len(self.get_dropped_files(task_id)),
            }
            return report
        return None


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <malware_sample> [cape_url]")
        sys.exit(1)

    url = sys.argv[2] if len(sys.argv) > 2 else "http://localhost:8000"
    client = CAPEClient(url)
    result = client.analyze_sample(sys.argv[1])
    if result:
        print(json.dumps(result, indent=2))

验证标准

• 样本在配置的超时时间内提交并分析完成
• 针对已知恶意软件家族触发了行为签名
• 由 cape-parsers 提取了恶意软件配置
• 捕获了网络流量并提取了 IOC
• 收集了释放的文件和载荷以供进一步分析
• 反规避绕过对沙箱感知型恶意软件有效

参考

• CAPEv2 GitHub
• CAPE Sandbox Documentation
• Automating Malware Analysis with CAPE
• Installing CAPEv2 on Ubuntu