[mndg]

Hello

I'd like to present you one open source sandbox solution I've been working since a few months with the purpose of analyze windows malware samples.

The setup is not very complex... you will need to prepare the environment (host and guest), use some windows os with virtual box, install and configure the applications, and do some basic checks....

This two days I've been working in the documentation (wiki). There you can find the instructions required to install this project in your system (mine is macosx)
https://code.google.com/p/mandingo/wiki/MandingoSandbox

The solution also comes with a web frontend for ease to use.

Any feedback will be appreciated :)

BTW, You can follow the messages related with this project in tweeter using the hashtag #mandingoSandbox
c'u

[EP_X0FF]

Just out of curiosity, why do you hook same api twice and convert unicode to ansi everywhere?

[mndg]

Hello

twice? where? :)

I converted unicode strings where I needed.. do you think should be recoded in a better way?

[mndg]

Because I need to getprocaddress both the unicode and the ascii functions I want to hook, do you know any alternative method?

[EP_X0FF]

If you hook unicode version of API this in most cases automatically cover ansi version, because most if ansi functions are just stubs with call for unicode variant. No need to hook same API twice.

[Buster_BSA]

Thanks for sharing the project publicly!

A few questions...

Is possible to inject our own DLL?

VMWare Tools installation is required?

In the wiki you wrote:

You need to configure an static IP for the operating system, so we can communicate the host (macosx/linux)

Why "(macosx/linux)" and not "(windows/macosx/linux)"?

Is not possible to use Windows as host?

[mndg]

Hello

Yes, with the "sinjector.exe" client you can inject any DLL to a new spawned process, or running by its PID.

Of course, you can use Linux or Windows for the host, but the instructions are not ready yet. If you understand how it works, I think you shouldn't have too many problems to set up the laboratory properly :)

VMware tools isn't required

[Buster_BSA]

Hello

Yes, with the "sinjector.exe" client you can inject any DLL to a new spawned process, or running by its PID.

Of course, you can use Linux or Windows for the host, but the instructions are not ready yet. If you understand how it works, I think you shouldn't have too many problems to set up the laboratory properly :)

VMware tools isn't required

Thanks for replying questions.

It would be nice if you can write a guide to setup the sandbox on Windows.

Does "sinjector.exe" client inject the DLL to new processes too? Let´s say a malware injects code to explorer.exe. Is our DLL injected to explorer.exe also?

Please check your private messages.