monnappa22 / limon Goto Github PK

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

License: GNU General Public License v3.0

Python 100.00%

limon's People

Contributors

Stargazers

Watchers

Forkers

upxnoops crimefire idkwim akshayjaing rajivraj cyberwhicker anantshri-clones sokoban tun4 pluckljn yeyintminthuhtut initpwn hxp2k6 lawrencehero defanlt securitywarrior xditx32 urwithajit9 guardianrg gansakumar adhokshajmishra kanagasabapathi mhanne0915 453483289 redteamcaliber cysinfo samyoyo songofhack deki0r alma4rebi miauwuffmiau lucabongiorni ellipsys secforks psjoshi ob1xxx 1ux10 diamondhead90 dikien jackbro rotemsalinas ulrich29 shekkbuilder appcoreopc m00zh33 sicceer enfreeworld mehulrijawani ankurjain41282 abuuuu tobey123 h0k5 rdsece shubhamk06 cikgufatah pombredanne alienzox heikipikker lukw00heck subc0ol forestmonster ustbgaofan 5up3rc swamim asing012 a-min3 grukz jack51706 djepunk97 yqyunjie orcsir marciopocebon tkunwar ajgappmark miguelraulb dmknght beyondcy forkarepo tirthikas cybernetics wangruowen threathive a-new rahulroshan96 eragon226 fzxcp3 raimundojimenez acealchemycyberblaze testcc2c newkrwang dekoder sharad1126 litchi125 carloanez cybersecops tmxk4221 onesorzer0es smkanji marcoshat rmk0017

limon's Issues

wonder how to get the /inetsim/log/service.log

Traceback (most recent call last):
File "limon.py", line 479, in
inetsim_log_data = inetsim.get_inetsim_log_data()
File "/home/qiqingh/Desktop/sandboxCollection/Limon/dyan.py", line 86, in get_inetsim_log_data
log_data = open(service_log).read()
IOError: [Errno 2] No such file or directory: '/usr/share/inetsim/log/service.log'

get the above error, wonder anyone solves this before? thanks!

how can i use kvm to do it

problem with sysdig

It is showing error while analysing malware on limon
can't open file /root/linux_reports/DoS.Linux.Melt.b/capture.scap

where DoS.Linux.Melt.b is a malware

error while running

Traceback (most recent call last):
File "limon.py", line 27, in
from statan import *
File "/home/mrunal/Limon/statan.py", line 27, in
import magic
ImportError: No module named magic

transferring file to virtual machine Error: You do not have access rights to this file

Hi Monnappa,

I have installed Limon, following your documents, after solving various issues, I was stopped here.
Please help me on this.
"transferring file to virtual machine Error: You do not have access rights to this file"

Running on Terminal
root@Ubuntu-Test:~/limon_sandbox# python limon.py /root/linux_malwares/setup.py -t 60 -P
Filetype: Python script, ASCII text executable
File Size: 1.59 KB (1630 bytes)
md5sum: 67d61bb66925ab9b35ac7bfc7442d20c
ssdeep: Did not process files large enough to produce meaningful results
ssdeep: 48:id58ivWO7tN0C9lElj7apdJDlGFG2VGNBk/OG52fNvVYRaOwx:iD8gsCviXaDTGFhVGnk/OG52fNvVYRaZ
ssdeep: Did not process files large enough to produce meaningful results
ssdeep comparison:
/root/linux_malwares/setup.py matches /root/linux_reports/ssdeep_master.txt:/root/linux_malwares/setup.py (100)
/root/linux_malwares/setup.py matches /root/linux_reports/ssdeep_master.txt:/root/linux_malwares/setup.py (100)
/root/linux_malwares/setup.py matches /root/linux_reports/ssdeep_master.txt:/root/linux_malwares/setup.py (100)
/root/linux_malwares/setup.py matches /root/linux_reports/ssdeep_master.txt:/root/linux_malwares/setup.py (100)

Strings:
Ascii strings written to /root/linux_reports/setup.py/strings_ascii.txt

Unicode strings written to /root/linux_reports/setup.py/strings_unicode.txt

Malware Capabilities and classification using YARA rules:

[]

Virustotal:

Cannot get results from Virustotal: <urlopen error [Errno -3] Temporary failure in name resolution>

Starting virtual machine for analysis
...done...
adding ip port redirection entries
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT udp -- anywhere anywhere udp dpts:2:6 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:8 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:10:12 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:14:16 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:msp redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:20:36 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:38:52 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:54:bootpc redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:gopher:122 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:124:who redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:515:65535 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:echo redir ports 7
REDIRECT udp -- anywhere anywhere udp dpt:discard redir ports 9
REDIRECT udp -- anywhere anywhere udp dpt:daytime redir ports 13
REDIRECT udp -- anywhere anywhere udp dpt:17 redir ports 17
REDIRECT udp -- anywhere anywhere udp dpt:chargen redir ports 19
REDIRECT udp -- anywhere anywhere udp dpt:time redir ports 37
REDIRECT udp -- anywhere anywhere udp dpt:domain redir ports 53
REDIRECT udp -- anywhere anywhere udp dpt:tftp redir ports 69
REDIRECT udp -- anywhere anywhere udp dpt:ntp redir ports 123
REDIRECT udp -- anywhere anywhere udp dpt:syslog redir ports 514
REDIRECT tcp -- anywhere anywhere tcp dpts:2:6 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:8:12 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:14:16 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:msp redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:ftp-data redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:ssh:24 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:26:36 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:38:52 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:54:78 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:81:pop2 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:sunrpc:112 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:114:442 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:snpp:kpasswd redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:466:ftps-data redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:991:ircs redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:996:6666 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:6668:65535 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:echo redir ports 7
REDIRECT tcp -- anywhere anywhere tcp dpt:daytime redir ports 13
REDIRECT tcp -- anywhere anywhere tcp dpt:qotd redir ports 17
REDIRECT tcp -- anywhere anywhere tcp dpt:chargen redir ports 19
REDIRECT tcp -- anywhere anywhere tcp dpt:ftp redir ports 21
REDIRECT tcp -- anywhere anywhere tcp dpt:smtp redir ports 25
REDIRECT tcp -- anywhere anywhere tcp dpt:time redir ports 37
REDIRECT tcp -- anywhere anywhere tcp dpt:domain redir ports 53
REDIRECT tcp -- anywhere anywhere tcp dpt:finger redir ports 79
REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 80
REDIRECT tcp -- anywhere anywhere tcp dpt:pop3 redir ports 110
REDIRECT tcp -- anywhere anywhere tcp dpt:auth redir ports 113
REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 443
REDIRECT tcp -- anywhere anywhere tcp dpt:urd redir ports 465
REDIRECT tcp -- anywhere anywhere tcp dpt:ftps redir ports 990
REDIRECT tcp -- anywhere anywhere tcp dpt:pop3s redir ports 995
REDIRECT tcp -- anywhere anywhere tcp dpt:ircd redir ports 6667
REDIRECT udp -- anywhere anywhere udp dpts:2:6 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:8 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:10:12 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:14:16 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:msp redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:20:36 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:38:52 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:54:bootpc redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:gopher:122 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:124:who redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:515:65535 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:echo redir ports 7
REDIRECT udp -- anywhere anywhere udp dpt:discard redir ports 9
REDIRECT udp -- anywhere anywhere udp dpt:daytime redir ports 13
REDIRECT udp -- anywhere anywhere udp dpt:17 redir ports 17
REDIRECT udp -- anywhere anywhere udp dpt:chargen redir ports 19
REDIRECT udp -- anywhere anywhere udp dpt:time redir ports 37
REDIRECT udp -- anywhere anywhere udp dpt:domain redir ports 53
REDIRECT udp -- anywhere anywhere udp dpt:tftp redir ports 69
REDIRECT udp -- anywhere anywhere udp dpt:ntp redir ports 123
REDIRECT udp -- anywhere anywhere udp dpt:syslog redir ports 514
REDIRECT tcp -- anywhere anywhere tcp dpts:2:6 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:8:12 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:14:16 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:msp redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:ftp-data redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:ssh:24 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:26:36 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:38:52 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:54:78 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:81:pop2 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:sunrpc:112 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:114:442 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:snpp:kpasswd redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:466:ftps-data redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:991:ircs redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:996:6666 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:6668:65535 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:echo redir ports 7
REDIRECT tcp -- anywhere anywhere tcp dpt:daytime redir ports 13
REDIRECT tcp -- anywhere anywhere tcp dpt:qotd redir ports 17
REDIRECT tcp -- anywhere anywhere tcp dpt:chargen redir ports 19
REDIRECT tcp -- anywhere anywhere tcp dpt:ftp redir ports 21
REDIRECT tcp -- anywhere anywhere tcp dpt:smtp redir ports 25
REDIRECT tcp -- anywhere anywhere tcp dpt:time redir ports 37
REDIRECT tcp -- anywhere anywhere tcp dpt:domain redir ports 53
REDIRECT tcp -- anywhere anywhere tcp dpt:finger redir ports 79
REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 80
REDIRECT tcp -- anywhere anywhere tcp dpt:pop3 redir ports 110
REDIRECT tcp -- anywhere anywhere tcp dpt:auth redir ports 113
REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 443
REDIRECT tcp -- anywhere anywhere tcp dpt:urd redir ports 465
REDIRECT tcp -- anywhere anywhere tcp dpt:ftps redir ports 990
REDIRECT tcp -- anywhere anywhere tcp dpt:pop3s redir ports 995
REDIRECT tcp -- anywhere anywhere tcp dpt:ircd redir ports 6667
REDIRECT udp -- anywhere anywhere udp dpts:2:6 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:8 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:10:12 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:14:16 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:msp redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:20:36 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:38:52 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:54:bootpc redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:gopher:122 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:124:who redir ports 1
REDIRECT udp -- anywhere anywhere udp dpts:515:65535 redir ports 1
REDIRECT udp -- anywhere anywhere udp dpt:echo redir ports 7
REDIRECT udp -- anywhere anywhere udp dpt:discard redir ports 9
REDIRECT udp -- anywhere anywhere udp dpt:daytime redir ports 13
REDIRECT udp -- anywhere anywhere udp dpt:17 redir ports 17
REDIRECT udp -- anywhere anywhere udp dpt:chargen redir ports 19
REDIRECT udp -- anywhere anywhere udp dpt:time redir ports 37
REDIRECT udp -- anywhere anywhere udp dpt:domain redir ports 53
REDIRECT udp -- anywhere anywhere udp dpt:tftp redir ports 69
REDIRECT udp -- anywhere anywhere udp dpt:ntp redir ports 123
REDIRECT udp -- anywhere anywhere udp dpt:syslog redir ports 514
REDIRECT tcp -- anywhere anywhere tcp dpts:2:6 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:8:12 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:14:16 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:msp redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:ftp-data redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:ssh:24 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:26:36 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:38:52 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:54:78 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:81:pop2 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:sunrpc:112 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:114:442 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:snpp:kpasswd redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:466:ftps-data redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:991:ircs redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:996:6666 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpts:6668:65535 redir ports 1
REDIRECT tcp -- anywhere anywhere tcp dpt:echo redir ports 7
REDIRECT tcp -- anywhere anywhere tcp dpt:daytime redir ports 13
REDIRECT tcp -- anywhere anywhere tcp dpt:qotd redir ports 17
REDIRECT tcp -- anywhere anywhere tcp dpt:chargen redir ports 19
REDIRECT tcp -- anywhere anywhere tcp dpt:ftp redir ports 21
REDIRECT tcp -- anywhere anywhere tcp dpt:smtp redir ports 25
REDIRECT tcp -- anywhere anywhere tcp dpt:time redir ports 37
REDIRECT tcp -- anywhere anywhere tcp dpt:domain redir ports 53
REDIRECT tcp -- anywhere anywhere tcp dpt:finger redir ports 79
REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 80
REDIRECT tcp -- anywhere anywhere tcp dpt:pop3 redir ports 110
REDIRECT tcp -- anywhere anywhere tcp dpt:auth redir ports 113
REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 443
REDIRECT tcp -- anywhere anywhere tcp dpt:urd redir ports 465
REDIRECT tcp -- anywhere anywhere tcp dpt:ftps redir ports 990
REDIRECT tcp -- anywhere anywhere tcp dpt:pop3s redir ports 995
REDIRECT tcp -- anywhere anywhere tcp dpt:ircd redir ports 6667

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

cleaning inetsim log directory
cleaning inetsim report directory
starting inetsim
Waiting for all the services to start
INetSim 1.2.5 (2014-05-24) by Matthias Eckert & Thomas Hungenberg
PIDfile '/var/run/inetsim.pid' exists - INetSim already running?
transferring file to virtual machine
Error: You do not have access rights to this file

Exiting the program
root@Ubuntu-Test:~/limon_sandbox#

Support for other virtualization software

Hello,

amazing project. I have one question. Are you planning support other virtualization software too? For example: Xen, KVM, VirtualBox...
Thanks.

Sub-process error

Hi,

It is a Amazing project. when we deployed the Limon we facing some issue in analyzing the file.
Are we missing some files. Please help us.

Filetype: Debian binary package (format 2.0)
File Size: 294.05 KB (301108 bytes)
md5sum: 90fb6fdf8e3e9014c9ca136dc590e0c4
ssdeep: 6144:KPtJQlgLirXcDwMuzWP9mowX2Hz5m96+tanGaEnCOLdY2+ho/boueFNQP1P1r:MslgurMEHzy9mf2Y4LG5JF+hoDoueod1
readelf: Error: Not an ELF file - it has the wrong magic bytes at the start
readelf: Error: Not an ELF file - it has the wrong magic bytes at the start
readelf: Error: Not an ELF file - it has the wrong magic bytes at the start
Traceback (most recent call last):
File "limon.py", line 190, in
elf_header = static.elf_header()
File "/home/samuser/Downloads/Limon-master/statan.py", line 123, in elf_header
output = subprocess.check_output(["readelf","-h",self.file])
File "/usr/lib/python2.7/subprocess.py", line 573, in check_output
raise CalledProcessError(retcode, cmd, output=output)
subprocess.CalledProcessError: Command '['readelf', '-h', '/root/Linux_malwares/inetsim_1.2.7-1_all.deb']' returned non-zero exit status 1

NOTE: While submitting the elf file also we facing the same issue.

Kindly help on this .

Thanks & Regards,
Avi.

is there any web interface to manager malware sandbox analysis

hi
I recently see some website like
https://detux.org/report.php?sha256=f8b64e60a8ef726ebc3ed73604f4d73dcd79edfb81ecf0825bb05b9404b2dee4
which has a malware upload、report show and search webinterface
i want to know will limon can support in the future?
or did you know any open source project can do that?

Error: The file is already in use

Limon sandbox is great but I have a problem, after the execution
python limon.py /root/linux_malwares/xxx.php -z -t 40 -m
md5sum strings yara is OK, then
Error: The file is already in use
Why is this ? Have you encountered this problem?

The specified guest user does not match the user currently logged in interactively

Getting error:



cleaning inetsim log directory
cleaning inetsim report directory
starting inetsim
Waiting for all the services to start
INetSim 1.3.1 (2019-08-16) by Matthias Eckert & Thomas Hungenberg
PIDfile '/var/run/inetsim.pid' exists - INetSim already running?
transferring file to virtual machine
...done...
starting Network Monitor
tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
executing file for 60 seconds
Error: The specified guest user does not match the user currently logged in interactively
Traceback (most recent call last):
  File "limon.py", line 390, in <module>
    analysis_vm.execute_strace(analysis_strace_path, analysis_strace_out_file, strace_filter, print_hexdump, analysis_file_path, params)
  File "/home/sajid/Limon-master/dyan.py", line 257, in execute_strace
    subprocess.check_call(cmd)
  File "/usr/lib/python2.7/subprocess.py", line 541, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['/usr/bin/vmrun', '-T', 'ws', '-gu', 'root', '-gp', '123456', 'runProgramInGuest', '/home/sajid/vmware/ubuntu14.vmx', '-noWait', '-activeWindow', '-interactive', '/usr/local/bin/strace', '-o', '/root/logdir/trace.txt', '-etrace=fork,clone,execve,chdir,open,creat,close,socket,connect,accept,bind,read,write,unlink,rename,kill,pipe,dup,dup2', '-s', '64', '-eread=all', '-ewrite=all', '-f', '/root/malware_analysis/0a29d465c6c8994145e546d89d403c1a']' returned non-zero exit status 255

Incomplete Analysis

Hello,

I just started using Limon, After all the configuration steps I ran the Limon.py file, it starts the analysis, transfers the malware into the analysis machine and stops after doing the tcpdump. I let it run for half an hour and it doesn't go further.

I used bridged network in VMware.
host-iface to sniff - eno1
The machines are able to ping each other.

I am unable to figure out the issue. Please help me!
Thank You

Got any update?

Still got any update or renew?

Can Limon go without submitting the file to VirusTotal by default

Can you make some of the analysis features like virustotal submission optional?

subprocess.CalledProcessError

I am attaching the log......................
transferring file to virtual machine
...done...
starting Network Monitor
tcpdump: eth0: SIOCETHTOOL(ETHTOOL_GET_TS_INFO) ioctl failed: No such device
executing file for 60 seconds
Error: The specified guest user does not match the user currently logged in interactively
Traceback (most recent call last):
File "limon.py", line 391, in
analysis_vm.execute_strace(analysis_strace_path, analysis_strace_out_file, strace_filter, print_hexdump, analysis_file_path, params)
File "/home/anmol/Downloads/Limon/dyan.py", line 257, in execute_strace
subprocess.check_call(cmd)
File "/usr/lib/python2.7/subprocess.py", line 541, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['/usr/bin/vmrun', '-T', 'ws', '-gu', 'root', '-gp', '12345', 'runProgramInGuest', '/home/anmol/vmware/Ubuntu 64-bit/Ubuntu 64-bit.vmx', '-noWait', '-activeWindow', '-interactive', '/usr/bin/strace', '-o', '/root/logdir/trace.txt', '-etrace=fork,clone,execve,chdir,open,creat,close,socket,connect,accept,bind,read,write,unlink,rename,kill,pipe,dup,dup2', '-s', '216', '-f', '/root/malware_analysis/VirusShare_f17fc913d1ddb607a0313737f3d655fe']' returned non-zero exit status 255

can you give your yara or behavior to us ?...please i don't know how to write

UnboundLocalError: local variable 'mem_file' referenced before assignment

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
RETURN     all  --  192.168.122.0/24     base-address.mcast.net/24 
RETURN     all  --  192.168.122.0/24     255.255.255.255     
MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24     masq ports: 1024-65535
MASQUERADE  udp  --  192.168.122.0/24    !192.168.122.0/24     masq ports: 1024-65535
MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24    
MASQUERADE  all  --  172.17.0.0/16        anywhere            

Chain DOCKER (2 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Starting Memory Analysis using Volatility
Traceback (most recent call last):
  File "limon.py", line 505, in <module>
    vol = Volatility(py_path, vol_path, analysis_vm.get_vmmem(), mem_image_profile)
  File "/home/sajid/Limon-master/dyan.py", line 182, in get_vmmem
    vmmem_path = os.path.join(dir_name, mem_file)
UnboundLocalError: local variable 'mem_file' referenced before assignment

AttributeError: 'module' object has no attribute 'open'

hello
when i start to run, i get bellow errors
Traceback (most recent call last):
File "limon.py", line 168, in
filetype = static.filetype()
File "/root/Limon/statan.py", line 46, in filetype
m = magic.open(magic.MAGIC_NONE)
AttributeError: 'module' object has no attribute 'open'

i think maybe magic doesn't has open method
so i test it
python
import magic
dir(magic)
get:
['MAGIC_CHECK', 'MAGIC_COMPRESS', 'MAGIC_CONTINUE', 'MAGIC_DEBUG', 'MAGIC_DEVICES', 'MAGIC_ERROR', 'MAGIC_MIME', 'MAGIC_MIME_ENCODING', 'MAGIC_NONE', 'MAGIC_NO_CHECK_APPTYPE', 'MAGIC_NO_CHECK_ASCII', 'MAGIC_NO_CHECK_COMPRESS', 'MAGIC_NO_CHECK_ELF', 'MAGIC_NO_CHECK_FORTRAN', 'MAGIC_NO_CHECK_SOFT', 'MAGIC_NO_CHECK_TAR', 'MAGIC_NO_CHECK_TOKENS', 'MAGIC_NO_CHECK_TROFF', 'MAGIC_PRESERVE_ATIME', 'MAGIC_RAW', 'MAGIC_SYMLINK', 'Magic', 'MagicException', 'builtins', 'doc', 'file', 'name', 'package', '_get_magic_type', '_instances', '_magic_buffer', '_magic_file', '_magic_load', 'c_char_p', 'c_int', 'c_size_t', 'c_void_p', 'coerce_filename', 'ctypes', 'dll', 'errorcheck_negative_one', 'errorcheck_null', 'from_buffer', 'from_file', 'glob', 'libmagic', 'magic_buffer', 'magic_check', 'magic_close', 'magic_compile', 'magic_errno', 'magic_error', 'magic_file', 'magic_load', 'magic_open', 'magic_setflags', 'magic_t', 'os', 'sys', 'threading']

not contatin open and load method

my env is:
Linux iZ230mc0fafZ 3.13.0-65-generic #106-Ubuntu SMP Fri Oct 2 22:08:27 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Python 2.7.6
python-magic version: 0.4.10

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.