understanding cuckoo sandbox json report
I have setup cuckoo sandbox and already analyzing some malware
the problem is im having a difficult time trying to understand the json report . could anyone please help me understand the following : UDP, procmemory, dns_servers , http , icmp, domains ,apistats ,processtree just a brief of what they are please attached sample picture of the json report thank you in advance
Well I think the output is pretty much clear if you just run one sample but anyway, if you want to better understand the output, you can check this paper.
As far as I know, "domains", "DNS", "UDP", "TCP",... show the communications of the sample using these protocols. For example, if a malware tries to connect to a URL, then you will have a DNS query in "DNS" section, an HTTP query in "HTTP" section, a domain name in "domains" section and a "UDP" communication in the "UDP" section (since DNS queries are usually over UDP protocol) all related to that one URL the malware tries to connect.
"apistats" shows the statistics about the API that are called by the sample file.
"procmemory" shows the details about different region of the memory with their size, protection level, start and end address.
I hope it helps.
- Trying to decode a JSON value that can be a String or Int
- Problem reading the returned JSON into PHP usable arrays in a foreach loop
- Using JQ query how to update propery inside two nested arrays?
- Swift4: UIImage from URL
- How can I create a JSON in R to match this schema?
- Can't load images from local files in React, React is trying to pull image from proxy?
- How to connect Javascript to Python sharing data with JSON format in both ways?
- Converting csv to json with jq
- Watson Assistant Integration with Phone Using Twilio
- Parse json in javascript - long numbers get rounded
- Obtaining information from a list/dict in Python
- Ignore Null Values When Serializing JSON
- How to build expression in ADF from json using parameterized variable?
- Laravel API stopped responding. How to return to service?
- JQ Cannot iterate over null
- Newtonsoft Object serialized to String. JObject instance expected
- Combine JSON objects from multiple rows into a single object
- Nested Json to pandas DataFrame with specific format
- Defining a HTML template to append using jQuery
- unbale to get the data from ORDS plsql block if input is an json array of objects
- How to get nested data in Gmail API and JSON with Python
- Convert from JSON object to expando object in c#
- Generate JSON from R data, tidyverse style
- How to read json file from assests in android using Kotlin?
- python jsonify dictionary in utf-8
- Replace empty string with null via JOLT SPEC
- polars (python-api): read_json fails to parse date
- How to get access the last item of a JSON array using Newtonsoft.Json SelectToken method
- Json server update
- Retrieve company name with ticker symbol input, yahoo or google API