• At least 5 GB of RAM

• VT-X extensions strongly recommended

• Install git and packer using your distribution’s packaging tool (packer is sometimes called packer-io)

• Install vagrant from their website : https://www.vagrantup.com/downloads.html (Installing from some distributions' packaging tools have caused issues).

• pip install malboxes:

  sudo pip3 install git+https://github.com/GoSecure/malboxes.git#egg=malboxes

Using Chocolatey

Manually

Run this command after normal installation:

This creates your base box that is imported in Vagrant. Afterwards you can re-use the same box several times per sample analysis.

Run:

You can also list all supported templates with:

This will build a Vagrant box ready for malware investigation you can now include it in a Vagrantfile afterwards.

For example:

The configuration section contains further information about what can be configured with malboxes.

This will create a Vagrantfile prepared to use for malware analysis. Move it into a directory of your choice and issue:

By default the local directory will be shared in the VM on the Desktop. This can be changed by commenting the relevant part of the Vagrantfile.

For example:

Malboxes can upload and interact with a VM on the Amazon Web serivces. To do so, follow these steps:

1. Malboxes will need a S3 bucket on AWS to upload the VM before converting it to an AMI (Amazon Machine Image). If you don’t have one, create one now.

2. Your instance also requires a security group with at least a rule allowing inbound connections for WinRM (Type: WinRM-HTTP, Protocol: TCP, Port Range: 5985, Source: host’s public IP).

3. Next, you need a vmimport service role configured. Follow the section named VM Import Service Role of this guide. These steps must be performed with an account that has iam:CreateRole and iam:PutRolePolicy permissions.

4. If the default config is used, change the hypervisor to aws and fill the mandatory options related. Otherwise, be sure to add all the options about AWS to your custom config.

5. Finally, you can follow the same steps described in the Box creation and the Per analysis instances sections to launch your instance!

AMI import status

pip install awscli

aws configure

aws ec2 describe-import-image-tasks

RDP

vagrant rdp -- /cert-ignore

Stopping an Instance

vagrant halt

Malboxes uses virtualbox as a back-end by default but since version 0.3.0 support for ESXi / vSphere has been added. Notes about the steps required for ESXi / vSphere support are available. Since everyone’s setup is a little bit different do not hesitate to open an issue if you encounter a problem or improve our documentation via a pull request.

We are exploring with the concept of profiles which are stored separately than the configuration and can be used to create files, alter the registry or install additional packages. See profile-example.js for an example configuration. This new capacity is experimental and subject to change as we experiment with it.

Currently, Malboxes does not support the automatic creation of the security groups, so you’ll have to use the AWS console to create yours. However, using the library Boto3 there should be a way to implement this.

Introduction video

• Introductory blog post: http://gosecure.net/2017/02/16/introducing-malboxes-a-tool-to-build-malware-analysis-virtual-machines/

malboxes was presented at NorthSec 2016 in a talk titled Applying DevOps Principles for Better Malware Analysis given by Olivier Bilodeau and Hugo Genesse

• Slides (HTML, best)

• Slides (PDF, degraded)

• Video