ph0neutria v0.9.1: malware crawler
ph0neutria is a malware zoo builder that sources samples straight from the wild. Everything is stored in Viper for ease of access and manageability.
This project was inspired by Ragpicker (https://github.com/robbyFux/Ragpicker, formerly known as “Malware Crawler”). However, ph0neutria aims to:
- Limit the scope of crawling to only frequently updated and reliable sources.
- Maximise the effectiveness of individual indicators.
- Offer a single, reliable and well-organized storage mechanism.
- Not do work that can instead be done by Viper.
- VX Vault.
OSINT. If required, passive DNS is used to produce a list of recent IP’s for a domain, and VirusTotal queried for recent URL’s pertaining to the IP. Only one source may be queried at any one time so as not to exceed VirusTotal API request limits. The resulting URL lists from each source are filtered by Levenshtein distance to reduce the number of similar items and are processed in their own thread.
- AlienVault OTX.
- CyberCrime Tracker.
- Payload Security (Hybrid Analysis).
The following script will install ph0neutria along with Viper and Tor:
chmod +x install.sh
Simple as that!
Configure additional ClamAV signatures:
Rename os.<yourdistro>.conf to os.conf, for example:
Modify configuration files:
- master.conf: search for “Enabled Databases” and enable/disable desired sources.
- user.conf: uncomment the required lines for sources you have enabled and complete them. user.conf overrides master.conf. You must uncomment user_configuration_complete=”yes” once you’ve completed setup for the following commands to succeed.
For more configuration info see: https://github.com/extremeshok/clamav-unofficial-sigs
cp systemd/* /etc/systemd
rm -rf clamav-unofficial-sigs
It’ll take a while to pull down the new signatures – during which time ClamAV may not be available.
Take precautions when piecing together your malware zoo:
- Do not disable Tor unless replacing with an anonymous VPN.
- Operate on an isolated network and on dedicated hardware.
- Only execute samples in a suitable Sandbox (refer: https://github.com/phage-nz/malware-hunting/tree/master/sandbox).
- Monitor for abuse of your API keys.
Ensure Tor is started:
service tor restart
Start the Viper API:
sudo -H -u spider python viper-api
Start the Viper web interface:
sudo -H -u spider python viper-web
- Complete the config file at: /opt/ph0neutria/config/settings.conf
- Complete the config file at: /home/spider/.viper/viper.conf
sudo -H -u spider python run.py
You can press Ctrl+C at any time to kill the run. You are free to run it again as soon as you’d like – you can’t end up with database duplicates.
To run this daily, create a script in /etc/cron.daily with the following:
cd /opt/ph0neutria && sudo -H -u spider python run.py
Copyright 2018 Chris Campbell (phage-nz)