Sandbagility: Framework to analyze malwares

Dependencies

Python 3.x: https://www.python.org/
Winbagility: https://github.com/Winbagility/Winbagility

Install

Sandbagility uses a modified version of VirtualBox (check Winbagility project).

VirtualBox

Uninstall other version of Virtualbox
Download the latest version (r3) in Winbagility github.
Unzip the downloaded package
The modified driver is not signed so to allow Windows to load unsigned driver :
```
bcdedit /set testsigning on
```
Reboot the pc
Install VirtualBox drivers, open a command line as Administator:

cd VBoxBin-r3\VBoxBin
set PATH=%PATH%;kmk
comregister.cmd
loadall.cmd

Click yes to load unsiged driver
Run VirtualBox.exe
Try to run a VM

! WARNING ! Winbagility support only 1 cpu and 2048 MB of RAM (max)

Winbagility

You can download a build version or compile it.

Build

Build FDP.dll

Download Visual Studio (2013, 2015, 2017)
Download CMake
Clone Winbagility

git clone https://github.com/Winbagility/Winbagility
cd Winbagility
buildVS20XX.bat

The built FDP dll in out_x64\Release

Download release

TODO

Install python bindings

git clone https://github.com/Winbagility/Winbagility
cd Winbagility\bindings\python
python3 setup.py install

Install Sandbagility Framework

git clone https://github.com/iNod3/sandbagility.git
cd sandbagility/Sandbagility
git clone https://github.com/iNod3/sandbagility-monitors.git Monitors
git clone https://github.com/iNod3/sandbagility-plugins.git Plugins
cd ..
python setup.py install

Configure the environment

Sandbagility needs the microsoft pdb to introspect the machine. Sandbagility uses the environment variable _NT_SYMBOLS_PATH to search symbols. You can use a local directory or an url.

set _NT_SYMBOLS_PATH=srv*C:\symbols*https://msdl.microsoft.com/download/symbols

Try sandbagility

Run a Vm in VirtualBox
Get the name of the VM in virtualBox (e.g. Win10_x64)
Download sandbagility examples:

git clone https://github.com/iNod3/sandbagility-examples.git
cd sandbagility-examples
python3 PsEnumSystemInformationTest.py Win10_x64

The script must print all processes and drivers information.

iNod3 / sandbagility