saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/analyzing-malware-behavior-with-cuckoo-sandbox/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.6 KiB
Raw Blame History

API Reference: Cuckoo Sandbox

Cuckoo CLI

Sample Submission

cuckoo submit /path/to/sample.exe
cuckoo submit --timeout 300 /path/to/sample.exe
cuckoo submit --machine win10_x64 --package exe sample.exe
cuckoo submit --url "http://malicious-url.com"

Status

cuckoo status
tail -f /opt/cuckoo/log/cuckoo.log

Cuckoo REST API

Submit File

curl -F "file=@sample.exe" -F "timeout=300" \
  http://localhost:8090/tasks/create/file

Response: {"task_id": 1}

Submit URL

curl -F "url=http://malicious.com" -F "timeout=300" \
  http://localhost:8090/tasks/create/url

Check Task Status

curl http://localhost:8090/tasks/view/<task_id>

Status values: pending, running, completed, reported

Get Report

curl http://localhost:8090/tasks/report/<task_id>
curl http://localhost:8090/tasks/report/<task_id>/json

List Tasks

curl http://localhost:8090/tasks/list
curl http://localhost:8090/tasks/list?limit=50&offset=0

Report JSON Structure

Key Paths

Path Content
info.score Threat score (0-10)
info.duration Analysis duration (seconds)
behavior.processes Process tree with API calls
behavior.summary.files Created/modified files
behavior.summary.keys Modified registry keys
network.dns DNS resolutions
network.http HTTP requests
network.tcp TCP connections
dropped Dropped files with hashes
signatures Triggered behavioral signatures

Signature Severity Levels

Level Meaning
1 Informational
2 Low
3 Medium
4 High
5 Critical

Analysis Packages

Package File Type
exe Windows executables
dll DLL files (uses rundll32)
doc Word documents
xls Excel spreadsheets
pdf PDF documents
js JavaScript files
vbs VBScript files
ps1 PowerShell scripts
zip Archives (auto-extracted)

InetSim - Network Simulation

Syntax

inetsim --bind-address 192.168.56.1
inetsim --report-dir /var/log/inetsim

Simulated Services

  • HTTP/HTTPS (ports 80, 443)
  • DNS (port 53)
  • SMTP (port 25)
  • FTP (port 21)
  • IRC (port 6667)

FakeNet-NG - Network Redirection

Syntax

fakenet
fakenet -c custom_config.ini

Volatility Integration

Syntax

vol3 -f /opt/cuckoo/storage/analyses/<id>/memory.dmp windows.pslist
vol3 -f /opt/cuckoo/storage/analyses/<id>/memory.dmp windows.malfind
vol3 -f /opt/cuckoo/storage/analyses/<id>/memory.dmp windows.netscan