weimingtom / malware-crawler Goto Github PK

Processing 
Virustotal Scan

Nach Ende eines Durchlaufs das temp-Verzeichnis löschen.

Processing
Office Dokumente herunterladen und Analysieren.
Siehe auch: pyOLEScanner
https://github.com/Evilcry/PythonScripts/blob/master/pyOLEScanner.py

Processing
zip archive entpacken und analysieren

Processing

upload samples to malware.lu

Processing
PDF Analyse mit pdftools und exiftool

What steps will reproduce the problem?
1. latest ragpicker
2. cuckoo 1.1
3. ubuntu 12.04

What is the expected output? What do you see instead?
submitting to cuckoo api generates errors and noting gets processed by sandbox

What version of the product are you using? On what operating system?


Please provide any additional information below.
ERROR core.worker worker:177 Failed to run the processing module 
"CuckooSandbox":
Traceback (most recent call last):
  File "/ragpicker/core/worker.py", line 164, in _run_processing
    data = processModul.run(objfile)
  File "/ragpicker/processing/cuckooSandbox.py", line 50, in run
    data = urllib2.urlopen(request).read()
  File "/usr/lib/python2.7/urllib2.py", line 126, in urlopen
    return _opener.open(url, data, timeout)
  File "/usr/lib/python2.7/urllib2.py", line 400, in open
    response = self._open(req, data)
  File "/usr/lib/python2.7/urllib2.py", line 418, in _open
    '_open', req)
  File "/usr/lib/python2.7/urllib2.py", line 378, in _call_chain
    result = func(*args)
  File "/usr/lib/python2.7/urllib2.py", line 1207, in http_open
    return self.do_open(httplib.HTTPConnection, req)
  File "/usr/lib/python2.7/urllib2.py", line 1174, in do_open
    h.request(req.get_method(), req.get_selector(), req.data, headers)
  File "/usr/lib/python2.7/httplib.py", line 958, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 992, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 954, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 814, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 776, in send
    self.connect()
  File "/usr/lib/python2.7/httplib.py", line 757, in connect
    self.timeout, self.source_address)
  File "/usr/lib/python2.7/socket.py", line 562, in create_connection
    sock.connect(sa)
  File "/ragpicker/utils/socks.py", line 375, in connect
    self.__negotiatesocks5(destpair[0],destpair[1])
  File "/ragpicker/utils/socks.py", line 240, in __negotiatesocks5
    raise Socks5Error(ord(resp[1]),err)
Socks5Error: <unprintable Socks5Error object>

ERROR core.worker worker:287 Failed to run the processing module "info":
Traceback (most recent call last):
  File "/opt/ragpicker/core/worker.py", line 274, in __run_processing
    data = processModul.run(objfile)
  File "/opt/ragpicker/processing/all_info.py", line 49, in run
    isProbablyPacked = is_probably_packed(pe)
  File "/opt/ragpicker/utils/peutils.py", line 575, in is_probably_packed
    if ((1.0 * total_compressed_data)/total_pe_data_length) > .2:
ZeroDivisionError: float division by zero
[+] Start search on 442368 bytes (432.0 KB)

What steps will reproduce the problem?
1. Run ragpicker.py (version 0.06.00) on an Ubuntu based machine through tor 
proxy does not seem to work. 
2.
3.

What is the expected output? What do you see instead?
downloading malware samples from various sources

What version of the product are you using? On what operating system?
ragpicker version 0.06.00 on Ubuntu 14.04 LTS.

ant fails due to /opt/ragpicker dependency. Necessary? 

I am trying to find a way to make this work with Viper instead of Vxcage now 
that Vxcage is being replaced.

What steps will reproduce the problem?
1. After install all dependencies i run ./ragpicker.py


What is the expected output? What do you see instead?

INFO Main ragpicker:131 RAGPICKER_VERSION: 0.2.2
INFO Main ragpicker:132 RAGPICKER_ROOT: /home/mrpink/malware-crawler
INFO Main ragpicker:138 Threads: 3
INFO Main ragpicker:76 Run Crawler: vxvault
INFO VxvaultCrawler vxvault:18 Fetching from VXVault List
INFO VxvaultCrawler vxvault:29 Found 101 urls
INFO Main ragpicker:145 Process 72 URLs
WARNING core.worker worker:60 Thread(2) - Thread(2) - HTTP Error 404: Not Found 
- Error parsing http://cezmosound.com/a.d5 - Error parsing 
http://cezmosound.com/a.d5
INFO core.objfile objfile:44 temp_file=/tmp/ragpicker-tmp/ragpicker_IWm8Uo.virus
WARNING core.worker worker:60 Thread(1) - 'module' object has no attribute 
'open' - Error parsing http://94.242.245.253/files/12/video_hd.exe
INFO core.objfile objfile:77 close tmpFile: 
/tmp/ragpicker-tmp/ragpicker_IWm8Uo.virus
INFO core.objfile objfile:44 temp_file=/tmp/ragpicker-tmp/ragpicker_vLIKMQ.virus
WARNING core.worker worker:60 Thread(2) - 'module' object has no attribute 
'open' - Error parsing http://3d7f0de36d.com/files/01/video_hd.exe


What version of the product are you using? 
Last version available on code.google.com
On what operating system?

Linux  3.2.0-4-amd64 #1 SMP Debian 3.2.46-1 x86_64 GNU/Linux

Please provide any additional information below.