kevoreilly/CAPEv2

A sandbox is used to execute malicious files in an isolated environment whilst instrumenting their dynamic behaviour and collecting forensic artefacts.

CAPE was derived from Cuckoo v1 which features the following core capabilities on the Windows platform:

• Behavioral instrumentation based on API hooking
• Capture of files created, modified and deleted during execution
• Network traffic capture in PCAP format
• Malware classification based on behavioral and network signatures
• Screenshots of the desktop taken during the execution of the malware
• Full memory dumps of the target system

CAPE complements Cuckoo's traditional sandbox output with several key additions:

• Automated dynamic malware unpacking
• Malware classification based on YARA signatures of unpacked payloads
• Static & dynamic malware configuration extraction
• Automated debugger programmable via YARA signatures, allowing:
  • Custom unpacking/config extractors
  • Dynamic anti-sandbox countermeasures
  • Instruction traces
• Interactive desktop

There is a free demonstration instance online that anyone can use:

https://capesandbox.com - For account activation reach to https://twitter.com/capesandbox

Cuckoo Sandbox started as a Google Summer of Code project in 2010 within The Honeynet Project. It was originally designed and developed by Claudio Guarnieri, the first beta release was published in 2011. In January 2014, Cuckoo v1.0 was released.

2015 was a pivotal year, with a significant fork in Cuckoo's history. Development of the original monitor and API hooking method was halted in the main Cuckoo project. It was replaced by an alternative monitor using a restructuredText-based signature format compiled via Linux toolchain, created by Jurriaan Bremer.

Around the same time, a fork called Cuckoo-modified was created by Brad 'Spender' Spengler continuing development of the original monitor with significant improvements including 64-bit support and importantly introducing Microsoft's Visual Studio compiler.