[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EYPRABQVYPEHZANDNBCZE":3,"skill-same:01M71EYPRABQVYPEHZANDNBCZE":60},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":14,"repositoryHtmlUrl":36,"repositoryHomepageUrl":6,"ownerHtmlUrl":37,"ownerBlogUrl":6,"ownerDescription":38,"updatedAt":39,"install":40,"resources":53},"01M71EYPRABQVYPEHZANDNBCZE","malware-analysis-automated-sandbox",null,"- [Automating Malware Analysis with CAPE](https:\u002F\u002Fendsec.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-analysis-automated-sandbox\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27],"sandbox","malware analysis","malware","analysis","malware analysis automated sandbox","cybersecurity","https","cape","with","2026-11-10 10:12:30",false,"---\nname: malware-analysis-automated-sandbox\ndescription: \"- [Automating Malware Analysis with CAPE](https:\u002F\u002Fendsec.\"\ndomain: cybersecurity\n---\n\n# Performing Automated Malware Analysis with CAPE\n\n## Overview\n\nCAPE (Config And Payload Extraction) is an open-source malware sandbox derived from Cuckoo that automates behavioral analysis, payload dumping, and configuration extraction. CAPEv2 features API hooking for behavioral instrumentation, captures files created\u002Fmodified\u002Fdeleted during execution, records network traffic in PCAP format, and includes 70+ custom configuration extractors (cape-parsers) for families like Emotet, TrickBot, Cobalt Strike, AsyncRAT, and Rhadamanthys. The signature system includes 1000+ behavioral signatures detecting evasion techniques, persistence, credential theft, and ransomware behavior. CAPE's debugger enables dynamic anti-evasion bypasses combining debugger actions within YARA signatures. Recommended deployment: Ubuntu LTS host with Windows 10 21H2 guest VM.\n\n## When to Use\n\n- When conducting security assessments that involve performing automated malware analysis with cape\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Ubuntu 22.04 LTS server (8+ CPU cores, 32GB+ RAM, 500GB+ SSD)\n- KVM\u002FQEMU virtualization support\n- Windows 10 21H2 guest image\n- Python 3.9+ with CAPEv2 dependencies\n- Network configuration for isolated analysis network\n\n## Workflow\n\n### Step 1: Submit and Analyze Samples via API\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"CAPE sandbox API client for automated malware submission and analysis.\"\"\"\nimport requests\nimport json\nimport time\nimport sys\nfrom pathlib import Path\n\nclass CAPEClient:\n    def __init__(self, base_url=\"http:\u002F\u002Flocalhost:8000\", api_token=None):\n        self.base_url = base_url.rstrip(\"\u002F\")\n        self.headers = {}\n        if api_token:\n            self.headers[\"Authorization\"] = f\"Token {api_token}\"\n\n    def submit_file(self, filepath, options=None):\n        \"\"\"Submit a file for analysis.\"\"\"\n        url = f\"{self.base_url}\u002Fapiv2\u002Ftasks\u002Fcreate\u002Ffile\u002F\"\n        files = {\"file\": open(filepath, \"rb\")}\n        data = options or {}\n        data.setdefault(\"timeout\", 120)\n        data.setdefault(\"enforce_timeout\", False)\n\n        resp = requests.post(url, files=files, data=data, headers=self.headers)\n        resp.raise_for_status()\n        result = resp.json()\n        task_id = result.get(\"data\", {}).get(\"task_ids\", [None])[0]\n        print(f\"[+] Submitted {filepath} -> Task ID: {task_id}\")\n        return task_id\n\n    def get_status(self, task_id):\n        \"\"\"Check task analysis status.\"\"\"\n        url = f\"{self.base_url}\u002Fapiv2\u002Ftasks\u002Fstatus\u002F{task_id}\u002F\"\n        resp = requests.get(url, headers=self.headers)\n        return resp.json().get(\"data\", \"unknown\")\n\n    def wait_for_completion(self, task_id, poll_interval=15, max_wait=600):\n        \"\"\"Wait for analysis to complete.\"\"\"\n        elapsed = 0\n        while elapsed \u003C max_wait:\n            status = self.get_status(task_id)\n            if status == \"reported\":\n                print(f\"[+] Task {task_id} completed\")\n                return True\n            time.sleep(poll_interval)\n            elapsed += poll_interval\n            print(f\"  Waiting... ({elapsed}s, status: {status})\")\n        return False\n\n    def get_report(self, task_id):\n        \"\"\"Retrieve full analysis report.\"\"\"\n        url = f\"{self.base_url}\u002Fapiv2\u002Ftasks\u002Fget\u002Freport\u002F{task_id}\u002F\"\n        resp = requests.get(url, headers=self.headers)\n        return resp.json()\n\n    def get_config(self, task_id):\n        \"\"\"Get extracted malware configuration.\"\"\"\n        report = self.get_report(task_id)\n        configs = report.get(\"CAPE\", {}).get(\"configs\", [])\n        return configs\n\n    def get_dropped_files(self, task_id):\n        \"\"\"List files dropped during analysis.\"\"\"\n        report = self.get_report(task_id)\n        return report.get(\"dropped\", [])\n\n    def get_network_iocs(self, task_id):\n        \"\"\"Extract network IOCs from analysis.\"\"\"\n        report = self.get_report(task_id)\n        network = report.get(\"network\", {})\n        iocs = {\n            \"dns\": [d.get(\"request\") for d in network.get(\"dns\", [])],\n            \"http\": [h.get(\"uri\") for h in network.get(\"http\", [])],\n            \"tcp\": [f\"{h.get('dst')}:{h.get('dport')}\"\n                    for h in network.get(\"tcp\", [])],\n        }\n        return iocs\n\n    def analyze_sample(self, filepath):\n        \"\"\"Full automated analysis pipeline.\"\"\"\n        task_id = self.submit_file(filepath)\n        if not task_id:\n            return None\n\n        if self.wait_for_completion(task_id):\n            report = {\n                \"task_id\": task_id,\n                \"config\": self.get_config(task_id),\n                \"network_iocs\": self.get_network_iocs(task_id),\n                \"dropped_files\": len(self.get_dropped_files(task_id)),\n            }\n            return report\n        return None\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cmalware_sample> [cape_url]\")\n        sys.exit(1)\n\n    url = sys.argv[2] if len(sys.argv) > 2 else \"http:\u002F\u002Flocalhost:8000\"\n    client = CAPEClient(url)\n    result = client.analyze_sample(sys.argv[1])\n    if result:\n        print(json.dumps(result, indent=2))\n```\n\n## Validation Criteria\n\n- Samples submitted and analyzed within configured timeout\n- Behavioral signatures triggered for known malware families\n- Malware configurations extracted by cape-parsers\n- Network traffic captured and IOCs extracted\n- Dropped files and payloads collected for further analysis\n- Anti-evasion bypasses effective against sandbox-aware malware\n\n## References\n\n- [CAPEv2 GitHub](https:\u002F\u002Fgithub.com\u002Fkevoreilly\u002FCAPEv2)\n- [CAPE Sandbox Documentation](https:\u002F\u002Fcapev2.readthedocs.io\u002F)\n- [Automating Malware Analysis with CAPE](https:\u002F\u002Fendsec.au\u002Fblog\u002Fbuilding-an-automated-malware-sandbox-using-cape\u002F)\n- [Installing CAPEv2 on Ubuntu](https:\u002F\u002Fmedium.com\u002F@rizqisetyokus\u002Fbuilding-capev2-automated-malware-analysis-sandbox-part-1-da2a6ff69cdb)\n","# Performing Automated Malware Analysis with CAPE\n\n## Overview\n\nCAPE (Config And Payload Extraction) is an open-source malware sandbox derived from Cuckoo that automates behavioral analysis, payload dumping, and configuration extraction. CAPEv2 features API hooking for behavioral instrumentation, captures files created\u002Fmodified\u002Fdeleted during execution, records network traffic in PCAP format, and includes 70+ custom configuration extractors (cape-parsers) for families like Emotet, TrickBot, Cobalt Strike, AsyncRAT, and Rhadamanthys. The signature system includes 1000+ behavioral signatures detecting evasion techniques, persistence, credential theft, and ransomware behavior. CAPE's debugger enables dynamic anti-evasion bypasses combining debugger actions within YARA signatures. Recommended deployment: Ubuntu LTS host with Windows 10 21H2 guest VM.\n\n## When to Use\n\n- When conducting security assessments that involve performing automated malware analysis with cape\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Ubuntu 22.04 LTS server (8+ CPU cores, 32GB+ RAM, 500GB+ SSD)\n- KVM\u002FQEMU virtualization support\n- Windows 10 21H2 guest image\n- Python 3.9+ with CAPEv2 dependencies\n- Network configuration for isolated analysis network\n\n## Workflow\n\n### Step 1: Submit and Analyze Samples via API\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"CAPE sandbox API client for automated malware submission and analysis.\"\"\"\nimport requests\nimport json\nimport time\nimport sys\nfrom pathlib import Path\n\nclass CAPEClient:\n    def __init__(self, base_url=\"http:\u002F\u002Flocalhost:8000\", api_token=None):\n        self.base_url = base_url.rstrip(\"\u002F\")\n        self.headers = {}\n        if api_token:\n            self.headers[\"Authorization\"] = f\"Token {api_token}\"\n\n    def submit_file(self, filepath, options=None):\n        \"\"\"Submit a file for analysis.\"\"\"\n        url = f\"{self.base_url}\u002Fapiv2\u002Ftasks\u002Fcreate\u002Ffile\u002F\"\n        files = {\"file\": open(filepath, \"rb\")}\n        data = options or {}\n        data.setdefault(\"timeout\", 120)\n        data.setdefault(\"enforce_timeout\", False)\n\n        resp = requests.post(url, files=files, data=data, headers=self.headers)\n        resp.raise_for_status()\n        result = resp.json()\n        task_id = result.get(\"data\", {}).get(\"task_ids\", [None])[0]\n        print(f\"[+] Submitted {filepath} -> Task ID: {task_id}\")\n        return task_id\n\n    def get_status(self, task_id):\n        \"\"\"Check task analysis status.\"\"\"\n        url = f\"{self.base_url}\u002Fapiv2\u002Ftasks\u002Fstatus\u002F{task_id}\u002F\"\n        resp = requests.get(url, headers=self.headers)\n        return resp.json().get(\"data\", \"unknown\")\n\n    def wait_for_completion(self, task_id, poll_interval=15, max_wait=600):\n        \"\"\"Wait for analysis to complete.\"\"\"\n        elapsed = 0\n        while elapsed \u003C max_wait:\n            status = self.get_status(task_id)\n            if status == \"reported\":\n                print(f\"[+] Task {task_id} completed\")\n                return True\n            time.sleep(poll_interval)\n            elapsed += poll_interval\n            print(f\"  Waiting... ({elapsed}s, status: {status})\")\n        return False\n\n    def get_report(self, task_id):\n        \"\"\"Retrieve full analysis report.\"\"\"\n        url = f\"{self.base_url}\u002Fapiv2\u002Ftasks\u002Fget\u002Freport\u002F{task_id}\u002F\"\n        resp = requests.get(url, headers=self.headers)\n        return resp.json()\n\n    def get_config(self, task_id):\n        \"\"\"Get extracted malware configuration.\"\"\"\n        report = self.get_report(task_id)\n        configs = report.get(\"CAPE\", {}).get(\"configs\", [])\n        return configs\n\n    def get_dropped_files(self, task_id):\n        \"\"\"List files dropped during analysis.\"\"\"\n        report = self.get_report(task_id)\n        return report.get(\"dropped\", [])\n\n    def get_network_iocs(self, task_id):\n        \"\"\"Extract network IOCs from analysis.\"\"\"\n        report = self.get_report(task_id)\n        network = report.get(\"network\", {})\n        iocs = {\n            \"dns\": [d.get(\"request\") for d in network.get(\"dns\", [])],\n            \"http\": [h.get(\"uri\") for h in network.get(\"http\", [])],\n            \"tcp\": [f\"{h.get('dst')}:{h.get('dport')}\"\n                    for h in network.get(\"tcp\", [])],\n        }\n        return iocs\n\n    def analyze_sample(self, filepath):\n        \"\"\"Full automated analysis pipeline.\"\"\"\n        task_id = self.submit_file(filepath)\n        if not task_id:\n            return None\n\n        if self.wait_for_completion(task_id):\n            report = {\n                \"task_id\": task_id,\n                \"config\": self.get_config(task_id),\n                \"network_iocs\": self.get_network_iocs(task_id),\n                \"dropped_files\": len(self.get_dropped_files(task_id)),\n            }\n            return report\n        return None\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cmalware_sample> [cape_url]\")\n        sys.exit(1)\n\n    url = sys.argv[2] if len(sys.argv) > 2 else \"http:\u002F\u002Flocalhost:8000\"\n    client = CAPEClient(url)\n    result = client.analyze_sample(sys.argv[1])\n    if result:\n        print(json.dumps(result, indent=2))\n```\n\n## Validation Criteria\n\n- Samples submitted and analyzed within configured timeout\n- Behavioral signatures triggered for known malware families\n- Malware configurations extracted by cape-parsers\n- Network traffic captured and IOCs extracted\n- Dropped files and payloads collected for further analysis\n- Anti-evasion bypasses effective against sandbox-aware malware\n\n## References\n\n- [CAPEv2 GitHub](https:\u002F\u002Fgithub.com\u002Fkevoreilly\u002FCAPEv2)\n- [CAPE Sandbox Documentation](https:\u002F\u002Fcapev2.readthedocs.io\u002F)\n- [Automating Malware Analysis with CAPE](https:\u002F\u002Fendsec.au\u002Fblog\u002Fbuilding-an-automated-malware-sandbox-using-cape\u002F)\n- [Installing CAPEv2 on Ubuntu](https:\u002F\u002Fmedium.com\u002F@rizqisetyokus\u002Fbuilding-capev2-automated-malware-analysis-sandbox-part-1-da2a6ff69cdb)\n",{"name":5,"domain":24,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-analysis-automated-sandbox","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-analysis-automated-sandbox",{"tool":46,"command":47},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-analysis-automated-sandbox",{"tool":49,"command":50},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-analysis-automated-sandbox","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-analysis-automated-sandbox\u002FSKILL.md",true,[54],{"path":55,"resourceType":56,"resourceTypeDesc":57,"sizeBytes":58,"sourceHtmlUrl":59},"index.json","REFERENCE","参考文档",558,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-analysis-automated-sandbox\u002Findex.json",[61,86,108,130,152,168],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":28},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,24,85],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":28},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[93,68,94,71,95,96,97,24,98,22,99,100,101,102,73,103,104,105,106,107],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":28},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[115,116,117,118,119,120,24,98,121,22,122,123,73,105,124,125,126,127,128,129],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":28},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[69,137,138,139,140,141,142,74,143,24,85,144,145,146,147,148,149,150,151,73],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":28},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[159,160,69,161,139,141,162,74,163,143,24,85,22,164,165,166,167,151,73,75],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":28},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[175,69,139,176,162,74,177,178,24,85,179,180,181,182,183,27,73,75,184,185],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","mismatched","headers"]