Cuckoo Sandbox Overview and Demo

[@TheCrookedPenguin]

This presentation is extremely helpful and detailed. Mr Yantorno explains everything with great detail. Also, this is a must-see video from anyone starting out with cuckoo. You helped me immensely, thank you very much.

[@pbr3s]

7:28 "you're inside a simulation of a simulation [...]"

[@TheSoDHater]

The male wares got me rolling though.

[@mmm-me4kk]

Hello, thank you for the presentation. Now Cuckoo is outdated and not really in use anymore, do you know some good alternatives?

[@rajrana-qx2on]

Thank you so much, Would you able to provide this slide/presentation by any chance?

[@dvdjonny]

Hey... Thanks for sharing this! is there anywhere I can read your Presentation online?

[@patrickkirchner4464]

Was that XP VM automatically reverted to the snapshot after each of the the malware samples was analyzed or would you need to manually do that?

[@maximumrpg3707]

Are you ever going to do more videos like this? Stuff like this is always interesting.

[@Puvipavan]

Can't you change system date to fast forward it when malware sleeps for 2 days?

[@manoharbaratam8792]

Nice video Yantorno, this is a must watch video for beginners of Cuckoo and can get a clear cut idea about what it is and how it works,. Please upload your presentation and the URL's in Video description which help people to directly view instead of pausing the video and typing it. Great work, really appreciated and please do make more videos like this

[@pashkaewall8857]

has anyone had any experience of taking action against a party whose repeatly sent metaexploited files to the opposition party in a litigation case?

[@jimivie]

Not too many videos on YouTUbe over an hour I finish....nice work

[@allanng78]

Hi, Did you install any addition prior to this demonstration?

[@absentfromtheworld]

Is it possible to setup and use Cuckoo without a virtualmachine running windows?

[@warrenperez9312]

I have been trying to install cuckoo on ubuntu but when running cuckoo and passing the malware using submit.py, cuckoo is unable to startup the virtual machine. Any ideas?

[@dansharvit725]

Can you run different AV's on each VM to test them against the malware?

[@bennybenassi9497]

Hi Chad, thank you for this Video. How did you get results for Hosts, DNS, Network (40:55), HTTP/HTTPS, TCP (42:22), because I get only UDP?

[@brianjigg6697]

How to add signature in cuckoo library? I have created a new signature for a ransomware and want to add it in cuckoo.

[@BhavdeepSinghSachdeva]

Is there some support for converting cuckoo json files created to MIST(Malware Instruction Sets) for machine learning analysis of these files.

[@wshep17]

any success?

[@EngMohannad1]

Thanks, very useful. Can I use Cuckoo for analyzing ELF binaries?

[@360dom360]

Do you have a download for any of the files you uploaded? I would like to go through some of these myself (running linux so no worries about getting a windows machine infected)

[@emilhozan71]

I'm pretty sure he directed you to the GitHub repo.

[@joyprakashsharma8234]

Mongodb isn't a fork of MySQL, The fork is MariaDB

[@rizkimaulana4645]

Hey, anyone know which one is called "system call"??

[@grootgroot1929]

Hi, You used guest vms inside cuckoo-vm. Can we have guest vm outside cuckoo vm? For ex. create 2 vms in virtual box. vm1 as cuckoo vm. vm2 as guest vm. Query open to everyone.

[@yashkhandelwalhyd]

Is there a way, I can get this presentation ??

[@michaelkasede1489]

Hi, great presentation. This presentation clearly should get more views and likes. Not to worry, many people out there are not cut out for this kind of work. Kudos mate!!

[@shamimlimon7585]

I am try to configure this but after load http: 127.0.0.1:8000 error message like this"""Template doesn't exit"" in web page. please help me..

[@emilhozan71]

did you run the two scripts required? what about rebooting the machines?

[@Juan-je3ml]

Mongo is not a fork of Mysql. you are referring to mariadb. Yara looks at characteristics of a certain file, not behavior. New version of cuckoo is also able to automatically implement ip tables for you so that you car have different exits. Also depending on your distro you might be falling behind on kernel upgrades due using apt upgrade instead of dist-upgrade (depends on your hardware enablement stack). just 2 cents.

[@chadyantorno]

Thanks for your comment. I was talking for about an hour and it's possible I misspoke in some instances. This video wasn't about Linux and kernel upgrades, it was about Cuckoo.

[@blusteel28]

Awesome video, thanks for posting!

[@steveswitzer4353]

Great many thanks i am going to try and get this up and working for my organisation

[@wrcz]

Chad Yantorno vs Virgin Malware

[@kognitiva]

Dont think that MongoDB is a fork of MySql. It's not the "same exact thing" :)

[@navjotsingh2251]

Yeah, it is not a fork. They are very different. MySQL is a relational database and mongo is a non relational database, their languages are very different too.

[@TheEggroll4321]

Good job! Very helpful

[@und3rgr0undfr34k]

awesome !

[@ibnomer342]

Thank you!

[@ca7986]

❤️👌

[@jfoter]

You lost me when you presented wrong facts. MariaDB is the form of MySQL after the Oracle purchase. Mongo is not a relational database like MySQL and MariaDB; Mongo is a Document based NoSQL database.

[@jfoter]

:s/Form/fork/

[@chadyantorno]

Thanks for the clarification. I'm always learning and it's possible I misspoke or was incorrect in some instances.

[@emilhozan71]

Do those technicalities really matter though? Have you put out any work regarding anything? By no means am I excusing his errors but it's not easy putting content out for fear of such scrutiny. The video wasn't about the history of MongDB / Linux commands / or anything OTHER THAN Cuckoo. Do you have any feedback about that, or did you stop it just to comment?