Cuckoo: Analysis stuck in pending state
Thanks for creating an issue! But first: did you read our community guidelines?
https://cuckoo.sh/docs/introduction/community.html
My issue is: Analysis stuck at pending.
My Cuckoo version and operating system are: cuckoo 2.06 on Ubuntu 16.04
This can be reproduced by: Submitting a file or URL for analysis
The log, error, files etc can be found at:
No log errors aside from displaying "pending" and the web logs show the following repeatedly:
[26/Jun/2018 16:44:38] "POST /analysis/api/tasks/info/ HTTP/1.1" 200 555
[26/Jun/2018 16:44:40] "POST /analysis/api/tasks/info/ HTTP/1.1" 200 555
[26/Jun/2018 16:44:43] "POST /analysis/api/tasks/info/ HTTP/1.1" 200 555
[26/Jun/2018 16:44:45] "POST /analysis/api/tasks/info/ HTTP/1.1" 200 555
[26/Jun/2018 16:44:48] "POST /analysis/api/tasks/info/ HTTP/1.1" 200 555
[26/Jun/2018 16:44:50] "POST /analysis/api/tasks/info/ HTTP/1.1" 200 555
[26/Jun/2018 16:44:53] "POST /analysis/api/tasks/info/ HTTP/1.1" 200 555
[26/Jun/2018 16:44:55] "POST /analysis/api/tasks/info/ HTTP/1.1" 200 555
bobbyg1
All 16 comments
Hi bobbyg1,
Thanks for posting an issue.
If analyses are all remaining on pending, I suspect Cuckoo itself is not running.
Cuckoo, Cuckoo web, Cuckoo API are all seperate processes.
Have you started Cuckoo? You can start it using cuckoo or cuckoo --debug. :smile:
RicoVZ
on 26 Jun 2018
I have cuckoo and the web console running fine (Here is the output when I run it through a venv)
(venv) xxxxxa@unicorn:~/venv/bin$ /home/xxxxx/venv/bin/cuckoo --cwd ~/.cuckoo
_______ _____ _____
/::\ \ /\ \ /\ \
/::::\ \ /::\____\ /::\ \
/::::::\ \ /::::| | /::::\ \
/::::::::\ \ /:::::| | /::::::\ \
/:::/~~\:::\ \ /::::::| | /:::/\:::\ \
/:::/ \:::\ \ /:::/|::| | /:::/ \:::\ \
/:::/ / \:::\ \ /:::/ |::| | /:::/ \:::\ \
/:::/____/ \:::____\ /:::/ |::|___|______ /:::/ / \:::\ \
|:::| | |:::| | /:::/ |::::::::\ \ /:::/ / \:::\ ___\
|:::|____| |:::| |/:::/ |:::::::::____\/:::/____/ ___\:::| |
\:::\ \ /:::/ / \::/ / ~/:::/ /\:::\ \ /\ /:::|____|
\:::\ \ /:::/ / \/____/ /:::/ / \:::\ /::\ \::/ /
\:::\ /:::/ / /:::/ / \:::\ \:::\ \/____/
\:::__/:::/ / /:::/ / \:::\ \:::____\
\::::::::/ / /:::/ / \:::\ /:::/ /
\::::::/ / /:::/ / \:::\/:::/ /
\::::/ / /:::/ / \::::::/ /
\::/____/ /:::/ / \::::/ /
~~ \::/ / \::/____/
\/____/
it's Cuckoo!
Cuckoo Sandbox 2.0.6
www.cuckoosandbox.org
Copyright (c) 2010-2018
Checking for updates...
You're good to go!
Our latest blogposts:
- Cuckoo Sandbox 2.0.6, June 07, 2018.
Interim release awaiting the big release.
More at https://cuckoosandbox.org/blog/206-interim-release
Cuckoo Sandbox 2.0.5: Office DDE, December 03, 2017.
Brand new release based on a DDE case study.
More at https://cuckoosandbox.org/blog/205-office-ddeCuckoo Sandbox 2.0.4, September 06, 2017.
Introducing Malware Configuration Extraction.
More at https://cuckoosandbox.org/blog/cuckoo-sandbox-204
2018-06-27 11:06:35,702 [cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager
Web interface startup:
:~/.cuckoo$ /home/xxxxx/venv/bin/cuckoo --cwd ~/.cuckoo web
Performing system checks...
System check identified no issues (0 silenced).
June 27, 2018 - 11:08:58
Django version 1.8.4, using settings 'cuckoo.web.web.settings'
Starting development server at http://localhost:8000/
Quit the server with CONTROL-C.
bobbyg1
on 27 Jun 2018
Here it is running in debug, I also have rooter running:
/_____/\ /_/\/_/\ /_____/\ /___/\/__/\ /_____/\ /_____/\
\:::__\/ \:\ \:\ \:::__\/ \::.\ \ \ \:::_ \ \:::_ \ \
\:\ \ __\:\ \:\ \:\ \ __\:: \/_) \ \:\ \ \ \:\ \ \ \
\:\ \/_/\:\ \:\ \:\ \/_/\:. __ ( ( \:\ \ \ \:\ \ \ \
\:_\ \ \:_\:\ \:_\ \ \: \ ) \ \ \:_\ \ \:_\ \ \
_____\/ _____\/ _____\/ __\/__\/ _____\/ _____\/
Cuckoo Sandbox 2.0.6
www.cuckoosandbox.org
Copyright (c) 2010-2018
Checking for updates...
You're good to go!
Our latest blogposts:
- Cuckoo Sandbox 2.0.6, June 07, 2018.
Interim release awaiting the big release.
More at https://cuckoosandbox.org/blog/206-interim-release
Cuckoo Sandbox 2.0.5: Office DDE, December 03, 2017.
Brand new release based on a DDE case study.
More at https://cuckoosandbox.org/blog/205-office-ddeCuckoo Sandbox 2.0.4, September 06, 2017.
Introducing Malware Configuration Extraction.
More at https://cuckoosandbox.org/blog/cuckoo-sandbox-204
2018-06-27 11:18:45,830 [cuckoo.core.startup] DEBUG: Imported modules...
2018-06-27 11:18:45,834 [cuckoo.core.startup] DEBUG: Imported "auxiliary" modules:
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: |-- MITM
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: |-- Reboot
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: |-- Services
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: -- Sniffer
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: Imported "machinery" modules:
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: |-- vSphere
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: |-- KVM
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: |-- ESX
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: |-- XenServer
2018-06-27 11:18:45,835 [cuckoo.core.startup] DEBUG: |-- VMware
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- Avd
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- QEMU
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- VirtualBox
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG:-- Physical
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: Imported "processing" modules:
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- AnalysisInfo
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- ApkInfo
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- Baseline
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- BehaviorAnalysis
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- Debug
2018-06-27 11:18:45,836 [cuckoo.core.startup] DEBUG: |-- Droidmon
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- Dropped
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- DroppedBuffer
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- Extracted
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- GooglePlay
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- Irma
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- Memory
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- MetaInfo
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- MISP
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- NetworkAnalysis
2018-06-27 11:18:45,837 [cuckoo.core.startup] DEBUG: |-- ProcessMemory
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- Procmon
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- Screenshots
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- Snort
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- Static
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- Strings
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- Suricata
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- TargetInfo
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- TLSMasterSecrets
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: -- VirusTotal
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: Imported "signatures" modules:
2018-06-27 11:18:45,838 [cuckoo.core.startup] DEBUG: |-- AndroidAbortBroadcast
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidAccountInfo
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidAppInfo
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidAudio
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidCamera
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidDangerousPermissions
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidDeletedApp
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidDynamicCode
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidEmbeddedApk
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidGooglePlayDiff
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidInstalledApps
2018-06-27 11:18:45,839 [cuckoo.core.startup] DEBUG: |-- AndroidNativeCode
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- AndroidPhoneNumber
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- AndroidPrivateInfoQuery
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- AndroidReflectionCode
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- AndroidRegisteredReceiver
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- AndroidShellCommands
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- AndroidSMS
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- AndroidStopProcess
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- ApplicationUsesLocation
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- KnownVirustotal
2018-06-27 11:18:45,840 [cuckoo.core.startup] DEBUG: |-- AntiAnalysisJavascript
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- DumpedBuffer
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- DumpedBuffer2
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- EncryptionKeys
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- EvalJS
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- HtmlFlash
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- JsIframe
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- PDFAttachments
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- PDFJavaScript
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- PDFOpenAction
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- PDFOpenActionJS
2018-06-27 11:18:45,841 [cuckoo.core.startup] DEBUG: |-- SuspiciousJavascript
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- DarwinCodeInjection
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- TaskForPid
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- DeadHost
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- NetworkBIND
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- NetworkCnCHTTP
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- NetworkDNSTXTLookup
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- NetworkDynDNS
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- NetworkHTTP
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- NetworkHTTPPOST
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- NetworkICMP
2018-06-27 11:18:45,842 [cuckoo.core.startup] DEBUG: |-- NetworkIRC
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- NetworkSMTP
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- NoLookupCommunication
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- P2PCnC
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- SnortAlert
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- SuricataAlert
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- Suspicious_TLD
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- TorGateway
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- WscriptDownloader
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- AddsUser
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- AddsUserAdmin
2018-06-27 11:18:45,843 [cuckoo.core.startup] DEBUG: |-- ADS
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- Adzok
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- AlinaFile
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- AlineURL
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- AllocatesExecuteRemoteProccess
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- AllocatesRWX
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- AmsiBypass
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- Andromeda
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- AntiAnalysisDetectFile
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- AntiAVDetectFile
2018-06-27 11:18:45,844 [cuckoo.core.startup] DEBUG: |-- AntiAVDetectReg
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiAVServiceStop
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiAVSRP
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiDBGDevices
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiDBGWindows
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntisandboxClipboard
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiSandboxFile
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiSandboxForegroundWindow
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiSandboxIdleTime
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiSandboxRestart
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiSandboxSleep
2018-06-27 11:18:45,845 [cuckoo.core.startup] DEBUG: |-- AntiVirusIRMA
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AntiVMBios
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AntiVMComputernameQuery
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AntiVMCPU
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AntiVMDiskSize
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AntiVMIDE
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AntiVMSCSI
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AntiVMServices
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AntiVMSharedDevice
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- ApplicationExceptionCrash
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- AppLockerBypass
2018-06-27 11:18:45,846 [cuckoo.core.startup] DEBUG: |-- APT_Carbunak
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- APT_CloudAtlas
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- apt_sandworm_ip
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- apt_sandworm_url
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- ArdamaxMutexes
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- AthenaHttp
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- AthenaURL
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- Autorun
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- AvastDetectLibs
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- AVDetectionChinaKey
2018-06-27 11:18:45,847 [cuckoo.core.startup] DEBUG: |-- BadCerts
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- Bagle
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- Bandook
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- banker_bancos
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- BankingMutexes
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- Banload
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- Beastdoor
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- BeebusMutexes
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- BegseabugTDMutexes
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- BetabotURL
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- Bifrose
2018-06-27 11:18:45,848 [cuckoo.core.startup] DEBUG: |-- BitcoinOpenCL
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- BitcoinWallet
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- BitdefenderDetectLibs
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- BlackEnergyMutexes
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- Blackhole
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- BlackholeURL
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- Blackice
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- BlackposURL
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- BlackRevMutexes
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- Blackshades
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- BladabindiMutexes
2018-06-27 11:18:45,849 [cuckoo.core.startup] DEBUG: |-- BochsDetectKeys
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- Bootkit
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- Bottilda
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- BozokKey
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- browser_startpage
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- BrowserSecurity
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- BrowserStealer
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- Btcbotnet
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- Bublik
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- BuildLangID
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- BuzusMutexes
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- BypassFirewall
2018-06-27 11:18:45,850 [cuckoo.core.startup] DEBUG: |-- c24URL
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- CarberpMutexes
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- Ceatrg
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- ChanitorMutexes
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- CheckIP
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- ChecksDebugger
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- ChecksKernelDebugger
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- ClearPermissionEventLogs
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- ClearsEventLogs
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- ClickfraudCookies
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- cloud_mediafire
2018-06-27 11:18:45,851 [cuckoo.core.startup] DEBUG: |-- cloud_wetransfer
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CloudFlare
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CloudGoogle
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CoinminerMutexes
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- ComRAT
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- ConsoleOutput
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- Crash
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CreatesAutorunInf
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CreatesDocument
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CreatesExe
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CreatesHiddenFile
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CreatesLargeKey
2018-06-27 11:18:45,852 [cuckoo.core.startup] DEBUG: |-- CreatesNullRegistryEntry
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- CreatesService
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- CreatesShortcut
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- CreatesSuspiciousProcess
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- CredentialDumpingLsass
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- CredentialDumpingLsassAccess
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- Cridex
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- CryptGenKey
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- Cryptolocker
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- CryptoMiningStratumCommand
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- CuckooDetectFiles
2018-06-27 11:18:45,853 [cuckoo.core.startup] DEBUG: |-- Cybergate
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- Dapato
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- Darkcloud
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- DarkddosMutexes
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- Darkshell
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- Ddos556
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- Decay
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- DecebalMutexes
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- DeepFreezeMutex
2018-06-27 11:18:45,854 [cuckoo.core.startup] DEBUG: |-- DeletesExecutedFiles
2018-06-27 11:18:45,855 [cuckoo.core.startup] DEBUG: |-- DelfTrojan
2018-06-27 11:18:45,855 [cuckoo.core.startup] DEBUG: |-- DEPHeapBypass
2018-06-27 11:18:45,855 [cuckoo.core.startup] DEBUG: |-- DEPStackBypass
2018-06-27 11:18:45,855 [cuckoo.core.startup] DEBUG: |-- DerusbiMutexes
2018-06-27 11:18:45,855 [cuckoo.core.startup] DEBUG: |-- Dexter
2018-06-27 11:18:45,855 [cuckoo.core.startup] DEBUG: |-- Dibik
2018-06-27 11:18:45,855 [cuckoo.core.startup] DEBUG: |-- DirtJumper
2018-06-27 11:18:45,856 [cuckoo.core.startup] DEBUG: |-- DisableCmd
2018-06-27 11:18:45,856 [cuckoo.core.startup] DEBUG: |-- DisableRegedit
2018-06-27 11:18:45,856 [cuckoo.core.startup] DEBUG: |-- DisablesAppLaunch
2018-06-27 11:18:45,856 [cuckoo.core.startup] DEBUG: |-- DisablesBrowserWarn
2018-06-27 11:18:45,856 [cuckoo.core.startup] DEBUG: |-- DisablesIEHTTP2
2018-06-27 11:18:45,856 [cuckoo.core.startup] DEBUG: |-- DisablesProxy
2018-06-27 11:18:45,856 [cuckoo.core.startup] DEBUG: |-- DisablesSecurity
2018-06-27 11:18:45,856 [cuckoo.core.startup] DEBUG: |-- DisablesSPDYChrome
2018-06-27 11:18:45,857 [cuckoo.core.startup] DEBUG: |-- DisablesSPDYFirefox
2018-06-27 11:18:45,857 [cuckoo.core.startup] DEBUG: |-- DisablesSPDYIE
2018-06-27 11:18:45,857 [cuckoo.core.startup] DEBUG: |-- DisablesSystemRestore
2018-06-27 11:18:45,857 [cuckoo.core.startup] DEBUG: |-- DisablesWER
2018-06-27 11:18:45,857 [cuckoo.core.startup] DEBUG: |-- DisablesWindowsUpdate
2018-06-27 11:18:45,857 [cuckoo.core.startup] DEBUG: |-- DisableTaskMgr
2018-06-27 11:18:45,857 [cuckoo.core.startup] DEBUG: |-- DiskInformation
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- Dns_Freehosting_Domain
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- dnsserver_dynamic
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- DocumentClose
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- DocumentOpen
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- DoFoil
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- DownloaderCabby
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- Dridex_APIs
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- Drive
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- Drive2
2018-06-27 11:18:45,858 [cuckoo.core.startup] DEBUG: |-- DriverLoad
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- DropBox
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- Dropper
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- Dyreza
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- EclipseMutexes
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- Emotet
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- Emotet_APIs
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- Evilbot
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- ExcelDataLinks
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- ExeAppData
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- ExecBitsAdmin
2018-06-27 11:18:45,859 [cuckoo.core.startup] DEBUG: |-- ExecWaitFor
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- exp_3322_dom
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- Expiro
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- ExploitHeapspray
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- ExploitKitMutexes
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- FakeAVMutexes
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- FakeAVMutexes
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- FakeRean
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- FarFli
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- FesberMutexes
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- Fingerprint
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- Flame
2018-06-27 11:18:45,860 [cuckoo.core.startup] DEBUG: |-- Flystudio
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- FortinetDetectFiles
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- FTPStealer
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- Fynloski
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- Gaelicum
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- Ghostbot
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- HasAuthenticode
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- HasOfficeEps
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- HasPdb
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- HasWMI
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- Hesperbot
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- Hidden_Window
2018-06-27 11:18:45,861 [cuckoo.core.startup] DEBUG: |-- Hikit
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- HookMouse
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- Hupigon
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- HyperVDetectKeys
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- IcePoint
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- im_btb
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- im_qq
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- IMStealer
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- InceptionAPT
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- Infinity
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- InfoStealerClipboard
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- InjectionCreateRemoteThread
2018-06-27 11:18:45,862 [cuckoo.core.startup] DEBUG: |-- InjectionExplorer
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InjectionModifiesMemory
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InjectionNetworkTraffic
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InjectionProcessSearch
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InjectionQueueApcThread
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InjectionRunPE
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InjectionWriteMemory
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InjectionWriteMemoryEXE
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InstalledApps
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InstallsAppInit
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InstallsBHO
2018-06-27 11:18:45,863 [cuckoo.core.startup] DEBUG: |-- InstallsWinpcap
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- IPKillerMutexes
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- Ircbrute
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- ISRstealerURL
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- iStealerURL
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- JackPOSFile
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- JackposURL
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- JavaScriptCommandline
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- JeefoMutexes
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- Jewdo
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- JintorMutexes
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- JorikTrojan
2018-06-27 11:18:45,864 [cuckoo.core.startup] DEBUG: |-- Karagany
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- Karakum
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- Katusha
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- KelihosBot
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- Keylogger
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- Kilim
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- Killdisk
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- KnownVirustotal
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- Koobface
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- Koutodoor
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- KovterBot
2018-06-27 11:18:45,865 [cuckoo.core.startup] DEBUG: |-- KrepperMutexes
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- KuluozMutexes
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- Likseput
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- LocatesBrowser
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- LocatesSniffer
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- Lockscreen
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- LolBot
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- Luder
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- Madness
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- Madness
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- MadnessURL
2018-06-27 11:18:45,866 [cuckoo.core.startup] DEBUG: |-- MaganiaMutexes
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- MailStealer
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- MaliciousDocumentURLs
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- MartianCommandProcess
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- MegaUpload
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- MemoryAvailable
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- MemoryProtectionRX
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- MetasploitShellcode
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- Minerbot
2018-06-27 11:18:45,867 [cuckoo.core.startup] DEBUG: |-- miningpool
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- MircFile
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifiesBootConfig
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifiesCertificates
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifiesDesktopWallpaper
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifiesFirefoxConfiguration
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifiesProxyAutoConfig
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifiesProxyOverride
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifiesProxyWPAD
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifiesUACNotify
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- ModifySecurityCenterWarnings
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- MovesSelf
2018-06-27 11:18:45,868 [cuckoo.core.startup] DEBUG: |-- Multiple_UA
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- MyBot
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- Nakbot
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- Napolar
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- Nebuler
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- Netobserve
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- Netshadow
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- Netwire
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- NetworkAdapters
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- NetworkDocumentFile
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- NetworkEXE
2018-06-27 11:18:45,869 [cuckoo.core.startup] DEBUG: |-- Nitol
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- NjRat
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- NtSetContextThreadRemote
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- Nymaim_APIs
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- ObfusMutexes
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- OfficeCheckName
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- OfficeCheckProjectName
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- OfficeCheckVersion
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- OfficeCheckWindow
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- OfficeCountDirectories
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- OfficeCreateObject
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- OfficeDDE
2018-06-27 11:18:45,870 [cuckoo.core.startup] DEBUG: |-- OfficeEpsStrings
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- OfficeHttpRequest
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- OfficeIndirectCall
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- OfficePackager
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- OfficePlatformDetect
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- OfficeRecentFiles
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- OfficeVulnerableGuid
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- OfficeVulnModules
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- Oldrea
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- PackerEntropy
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- Palevo
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- ParallelsDetectKeys
2018-06-27 11:18:45,871 [cuckoo.core.startup] DEBUG: |-- ParallelsDetectWindow
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- Pasta
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PcClientMutexes
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PEFeatures
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PEIDPacker
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PerfLogger
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PersistenceBootexecute
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PersistenceRegistryEXE
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PersistenceRegistryJavaScript
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PersistenceRegistryPowershell
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- PEUnknownResourceName
2018-06-27 11:18:45,872 [cuckoo.core.startup] DEBUG: |-- Phorpiex
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- Pidief
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- Plugx
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- Poebot
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- PoisonIvy
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- Polymorphic
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- Ponfoy
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- PonyURL
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- PosCardStealerURL
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- Powerfun
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- PowershellBitsTransfer
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- PowershellCcDns
2018-06-27 11:18:45,873 [cuckoo.core.startup] DEBUG: |-- PowershellDdiRc4
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PowershellDFSP
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PowershellDI
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PowershellDownload
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PowershellEmpire
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PowershellMeterpreter
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PowershellRegAdd
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PowershellRequest
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PowershellUnicorn
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- Powerworm
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- Prinimalka
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- PrivilegeLUIDCheck
2018-06-27 11:18:45,874 [cuckoo.core.startup] DEBUG: |-- ProcessInterest
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- ProcessMartian
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- ProcessNeeded
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- ProcMemDumpIPURLs
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- ProcMemDumpTORURLs
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- ProcMemDumpURLs
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- ProcMemDumpYara
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- Psyokym
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- PuceMutexes
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- PutterpandaMutexes
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- Putty
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- PWDumpFile
2018-06-27 11:18:45,875 [cuckoo.core.startup] DEBUG: |-- Pykse
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- Qakbot
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- QueriesInstalledApps
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- Ragebot
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- RaisesException
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- Ramnit
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- RamsomwareFileMoves
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- ransomware_viruscoder
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- RansomwareAppendsExtension
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- RansomwareBcdedit
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- RansomwareDroppedFiles
2018-06-27 11:18:45,876 [cuckoo.core.startup] DEBUG: |-- RansomwareExtensions
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RansomwareFiles
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RansomwareMassFileDelete
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RansomwareMessage
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RansomwareMessageOCR
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RansomwareRecyclebin
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RansomwareShadowcopy
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RansomwareWbadmin
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RapidShare
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- rat_fexel_ip
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- rat_naid_ip
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RatSiggen
2018-06-27 11:18:45,877 [cuckoo.core.startup] DEBUG: |-- RBot
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- RdpMutexes
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- ReadsUserAgent
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- Recon_Beacon
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- RemovesZoneIdADS
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- Renocide
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- RenosTrojan
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- ResumeThread
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- Rovnix
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- RTFCharacterSet
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- RTFUnknownVersion
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- Runbu
2018-06-27 11:18:45,878 [cuckoo.core.startup] DEBUG: |-- RunouceMutexes
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- Ruskill
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- Sadbot
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- SandboxieDetect
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- SandboxJoeAnubisDetectFiles
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- SDBot
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- SelfDeleteBat
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- Senna
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- Shadowbot
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- SharingRGhost
2018-06-27 11:18:45,879 [cuckoo.core.startup] DEBUG: |-- SharpStealerURL
2018-06-27 11:18:45,880 [cuckoo.core.startup] DEBUG: |-- ShellcodeWriteProcessMemory
2018-06-27 11:18:45,880 [cuckoo.core.startup] DEBUG: |-- Shiz
2018-06-27 11:18:45,880 [cuckoo.core.startup] DEBUG: |-- Shylock
2018-06-27 11:18:45,880 [cuckoo.core.startup] DEBUG: |-- SipStun
2018-06-27 11:18:45,880 [cuckoo.core.startup] DEBUG: |-- Smtp_GMail
2018-06-27 11:18:45,880 [cuckoo.core.startup] DEBUG: |-- Smtp_Live
2018-06-27 11:18:45,880 [cuckoo.core.startup] DEBUG: |-- Smtp_Mail_Ru
2018-06-27 11:18:45,880 [cuckoo.core.startup] DEBUG: |-- Smtp_Yahoo
2018-06-27 11:18:45,881 [cuckoo.core.startup] DEBUG: |-- SolarURL
2018-06-27 11:18:45,881 [cuckoo.core.startup] DEBUG: |-- SpyEyeMutexes
2018-06-27 11:18:45,881 [cuckoo.core.startup] DEBUG: |-- SpyeyeURL
2018-06-27 11:18:45,881 [cuckoo.core.startup] DEBUG: |-- SpynetRat
2018-06-27 11:18:45,881 [cuckoo.core.startup] DEBUG: |-- Spyrecorder
2018-06-27 11:18:45,881 [cuckoo.core.startup] DEBUG: |-- StackPivot
2018-06-27 11:18:45,881 [cuckoo.core.startup] DEBUG: |-- StackPivotShellcodeAPIs
2018-06-27 11:18:45,881 [cuckoo.core.startup] DEBUG: |-- StackPivotShellcodeCreateProcess
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- Staser
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- StealthChildProc
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- StealthHiddenExtension
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- StealthHiddenFile
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- StealthHiddenIcons
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- StealthHideNotifications
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- StealthSystemProcName
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- StopsService
2018-06-27 11:18:45,882 [cuckoo.core.startup] DEBUG: |-- SunbeltDetectFiles
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- SunBeltSandboxDetect
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- SuspiciousCommandTools
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- SuspiciousPowershell
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- SuspiciousWriteEXE
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- SweetorangeMutexes
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- Swrort
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- SysInternalsToolsUsage
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- SystemInfo
2018-06-27 11:18:45,883 [cuckoo.core.startup] DEBUG: |-- SystemMetrics
2018-06-27 11:18:45,884 [cuckoo.core.startup] DEBUG: |-- TapiDpMutexes
2018-06-27 11:18:45,884 [cuckoo.core.startup] DEBUG: |-- TDSSBackdoor
2018-06-27 11:18:45,884 [cuckoo.core.startup] DEBUG: |-- TeamviewerRat
2018-06-27 11:18:45,884 [cuckoo.core.startup] DEBUG: |-- TerminatesRemoteProcess
2018-06-27 11:18:45,884 [cuckoo.core.startup] DEBUG: |-- ThreatTrackDetectFiles
2018-06-27 11:18:45,884 [cuckoo.core.startup] DEBUG: |-- TinbaMutexes
2018-06-27 11:18:45,884 [cuckoo.core.startup] DEBUG: |-- TnegaMutexes
2018-06-27 11:18:45,884 [cuckoo.core.startup] DEBUG: |-- Tor
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- TorHiddenService
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- Travnet
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- Trogbot
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- TrojanJorik
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- TrojanLethic
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- TrojanLethic
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- trojanmrblack
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- TrojanRedosru
2018-06-27 11:18:45,885 [cuckoo.core.startup] DEBUG: |-- TrojanSysn
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- trojanyoddos
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- TufikMutexes
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- Turkojan
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- TurlaCarbon
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- UFRStealer
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- Unhook
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- Upatre
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- UpatreTDMutexes
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- UPXCompressed
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- UrkShortCN
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- URLFile
2018-06-27 11:18:45,886 [cuckoo.core.startup] DEBUG: |-- URLSpy
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- UroburosFile
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- UroburosMutexes
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- Urxbot
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- UsesWindowsUtilities
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- Vanbot
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- VBInject
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- VBoxDetectACPI
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- VBoxDetectDevices
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- VBoxDetectFiles
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- VBoxDetectKeys
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- VBoxDetectProvname
2018-06-27 11:18:45,887 [cuckoo.core.startup] DEBUG: |-- VBoxDetectWindow
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- Vertex
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VertexSolarURL
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VirtualPCDetect
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VirtualPCDetectWindow
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VirtualPCIllegalInstruction
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- Virut
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VMFirmware
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VMPPacked
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VMWareDetectFiles
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VMWareDetectKeys
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VMwareDetectWindow
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VMWareInInstruction
2018-06-27 11:18:45,888 [cuckoo.core.startup] DEBUG: |-- VncMutexes
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VNLoaderURL
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolDevicetree1
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolHandles1
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolLdrModules1
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolLdrModules2
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolMalfind1
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolModscan1
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolSvcscan1
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolSvcscan2
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VolSvcscan3
2018-06-27 11:18:45,889 [cuckoo.core.startup] DEBUG: |-- VPCDetectKeys
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- Wakbot
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WarbotURL
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- Whimoo
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- Win32ProcessCreate
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WineDetect
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WinSCP
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WinSxsBot
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WMIAntiVM
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WMIPersistance
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WMIService
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WormAllaple
2018-06-27 11:18:45,890 [cuckoo.core.startup] DEBUG: |-- WormKolabc
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- XenDetectKeys
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- XtremeRAT
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- Xworm
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- Zegost
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- ZeusMutexes
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- ZeusP2P
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- ZeusURL
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG:-- ZoneID
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: Imported "reporting" modules:
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- ElasticSearch
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- Feedback
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- JsonDump
2018-06-27 11:18:45,891 [cuckoo.core.startup] DEBUG: |-- Mattermost
2018-06-27 11:18:45,892 [cuckoo.core.startup] DEBUG: |-- MISP
2018-06-27 11:18:45,892 [cuckoo.core.startup] DEBUG: |-- Moloch
2018-06-27 11:18:45,892 [cuckoo.core.startup] DEBUG: |-- MongoDB
2018-06-27 11:18:45,892 [cuckoo.core.startup] DEBUG: |-- Notification
2018-06-27 11:18:45,892 [cuckoo.core.startup] DEBUG: `-- SingleFile
2018-06-27 11:18:45,897 [cuckoo.core.startup] DEBUG: Checking for locked tasks..
2018-06-27 11:18:45,906 [cuckoo.core.startup] DEBUG: Checking for pending service tasks..
2018-06-27 11:18:45,913 [cuckoo.core.startup] DEBUG: Initializing Yara...
2018-06-27 11:18:45,914 [cuckoo.core.startup] DEBUG: |-- binaries embedded.yar
2018-06-27 11:18:45,914 [cuckoo.core.startup] DEBUG: |-- binaries filetypes.yar
2018-06-27 11:18:45,915 [cuckoo.core.startup] DEBUG: |-- binaries shellcodes.yar
2018-06-27 11:18:45,915 [cuckoo.core.startup] DEBUG: |-- binaries vmdetect.yar
2018-06-27 11:18:45,916 [cuckoo.core.startup] DEBUG: |-- scripts applocker_bypass.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powerfun.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_AMSI.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_BITS_transfer.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_ddi_rc4.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_dfsp.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_di.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_empire.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_meterpreter.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_txt_c2.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powershell_unicorn.yar
2018-06-27 11:18:45,917 [cuckoo.core.startup] DEBUG: |-- scripts powerworm.yar
2018-06-27 11:18:45,918 [cuckoo.core.startup] DEBUG: |-- shellcode metasploit.yar
2018-06-27 11:18:45,919 [cuckoo.core.startup] DEBUG: |-- office dde.yar
2018-06-27 11:18:45,919 [cuckoo.core.startup] DEBUG: |-- office ole.yar
2018-06-27 11:18:45,919 [cuckoo.core.resultserver] DEBUG: ResultServer running on 192.168.56.1:2042.
2018-06-27 11:18:45,920 [cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager
bobbyg1
on 27 Jun 2018
@bobbyg1 Thanks for posting the logs.
2018-06-27 11:06:35,702 [cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager
Hm, there should be more output after this (about loading machines etc) if you run it with the --debug flag. Does the output actually stop here?
RicoVZ
on 27 Jun 2018
Yes the last entry is "2018-06-27 11:18:45,919 [cuckoo.core.resultserver] DEBUG: ResultServer running on 192.168.56.1:2042.
2018-06-27 11:18:45,920 [cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager"
And then it loads up virtual box
bobbyg1
on 27 Jun 2018
Just to re-cap, I have Cuckoo, cuckoo web, and cuckoo rooter running with the one single VM running windows 8.1 at the moment. The agent script is running at startup within the VM.
bobbyg1
on 27 Jun 2018
Stupid questions but
1 are they started in different consoles?
2 under which user you installed cuckoo? Which user runs cuckoo?
doomedraven
on 27 Jun 2018
Can you clarify what you mean by started in different consoles? This is installed and running on a physical workstation and I followed the instructions from cuckoo documentation with addidng the cuckoo user etc. Is there a quick way to make sure its running under the cuckoo user?
bobbyg1
on 27 Jun 2018
Cuckoo, cuckoo web cuckoo rooter cuckoo process should be running in prallel
doomedraven
on 27 Jun 2018
@bobbyg1
And then it loads up virtual box
Can you please post your virtualbox.conf? :smile:
I suspect Cuckoo is waiting for Virtualbox to exit, and therefore does not continue. If you post it, we can check if there are values that might cause this.
RicoVZ
on 27 Jun 2018
Sure:
cat /home/cuckoo/.cuckoo/conf/virtualbox.conf
[virtualbox]
# Specify which VirtualBox mode you want to run your machines on.
# Can be "gui" or "headless". Please refer to VirtualBox's official
# documentation to understand the differences.
mode = gui
# Path to the local installation of the VBoxManage utility.
path = /usr/bin/virtualbox
# If you are running Cuckoo on Mac OS X you have to change the path as follows:
# path = /Applications/VirtualBox.app/Contents/MacOS/VBoxManage
# Default network interface.
interface = vboxnet0
# Specify a comma-separated list of available machines to be used. For each
# specified ID you have to define a dedicated section containing the details
# on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3)
machines = Win_8
[Win_8]
# If remote control is enabled in cuckoo.conf, specify a port range to use.
# Virtualbox will bind the VRDP interface to the first available port.
#controlports = {{ virtualbox.virtualbox.controlports }}
#{% for machine in config("virtualbox:virtualbox:machines") %}
#[{{ machine }}]
# Specify the label name of the current machine as specified in your
# VirtualBox configuration.
#label = windows
label = Win_8
# Specify the operating system platform used by current machine
# [windows/darwin/linux].
platform = windows
# Specify the IP address of the current virtual machine. Make sure that the
# IP address is valid and that the host machine is able to reach it. If not,
# the analysis will fail.
ip = 192.168.56.101
# (Optional) Specify the snapshot name to use. If you do not specify a snapshot
# name, the VirtualBox MachineManager will use the current snapshot.
# Example (Snapshot1 is the snapshot name):
#snapshot = {{ virtualbox[machine].snapshot }}
snapshot = Snapshot 1
# (Optional) Specify the name of the network interface that should be used
# when dumping network traffic from this machine with tcpdump. If specified,
# overrides the default interface specified in auxiliary.conf
# Example (vboxnet0 is the interface name):
#interface = {{ virtualbox[machine].interface }}
interface = vboxnet0
# (Optional) Specify the IP of the Result Server, as your virtual machine sees it.
# The Result Server will always bind to the address and port specified in cuckoo.conf,
# however you could set up your virtual network to use NAT/PAT, so you can specify here
# the IP address for the Result Server as your machine sees it. If you don't specify an
# address here, the machine will use the default value from cuckoo.conf.
# NOTE: if you set this option you have to set result server IP to 0.0.0.0 in cuckoo.conf.
# Example:
resultserver_ip = 192.168.56.1
# (Optional) Specify the port for the Result Server, as your virtual machine sees it.
# The Result Server will always bind to the address and port specified in cuckoo.conf,
# however you could set up your virtual network to use NAT/PAT, so you can specify here
# the port for the Result Server as your machine sees it. If you don't specify a port
# here, the machine will use the default value from cuckoo.conf.
# Example:
#resultserver_port = 2042
# (Optional) Set your own tags. These are comma separated and help to identify
# specific VMs. You can run samples on VMs with tag you require.
#tags = {{ virtualbox[machine].tags }}
# Mostly unused for now. Please don't fill it out.
#options = {{ virtualbox[machine].options }}
# (Optional) Specify the OS profile to be used by volatility for this
# virtual machine. This will override the guest_profile variable in
# memory.conf which solves the problem of having multiple types of VMs
# and properly determining which profile to use.
#osprofile = {{ virtualbox[machine].osprofile }}
#{% endfor %}
[honeyd]
# For more information on this VM please refer to the "services" section of
# the conf/auxiliary.conf configuration file. This machine is a bit special
# in the way that its used as an additional VM for an analysis.
# *NOTE* that if this functionality is used, the VM should be registered in
# the "machines" list in the beginning of this file.
#label = honeyd
#platform = linux
#ip = 192.168.56.102
# The tags should at least contain "service" and the name of this service.
# This way the services auxiliary module knows how to find this particular VM.
#tags = service, honeyd
# Not all services actually have a Cuckoo Agent running in the VM, for those
# services one can specify the "noagent" option so Cuckoo will just wait until
# the end of the analysis instead of trying to connect to the non-existing
# Cuckoo Agent. We can't really intercept any inter-VM communication from the
# host / gateway so in order to dump traffic between VMs we have to use a
# different network dumping approach. For this machine we use the "nictrace"
# functionality from VirtualBox (which is basically their internal tcpdump)
# and thus properly dumps inter-VM traffic.
options = nictrace noagent
Ah, the problem is likely:
path = /usr/bin/virtualbox should be path = /usr/bin/VBoxManage. This is the binary Cuckoo needs to manage VMs.
The virtualbox binary opens a UI and does not exit until you close it. The other one exits after it is used.
RicoVZ
on 27 Jun 2018
I changed it to /usr/bin/VBoxManage but it didnt make a difference :(
bobbyg1
on 4 Jul 2018
@bobbyg1 how do you execute all cuckoo services?
doomedraven
on 4 Jul 2018
follow the manual isnot the answer, as everyone interprets it how they want it :D
doomedraven
on 4 Jul 2018
ok my friend just had this issue, the problem is the same which you have as i see redacted username
if you don't use cuckoo user to run all, you should to specify --user X to all services like
cuckoo --user X -d rooter
cuckoo --user X -d
cuckoo --user X -d process a1
cuckoo --user X -d web -H 0.0.0.0 -p 8000
Related issues
adricnet
路
7Comments
rodkinal
路
6Comments
jens1o
路
7Comments
myhsu
路
5Comments
kirill039
路
5Comments
Most helpful comment
follow the manual isnot the answer, as everyone interprets it how they want it :D