< CWSandbox vs. Spy.Banker | SecurityFocus: "Viruses, Phishing, and Trojans For Profit" >

Nepenthes and CWSandbox

It is also possible to use nepenthes together with CWSandbox: just change in the file submit-norman.cpp the line containing the option CURLOPT_URL (line 174) from "http://sandbox.norman.no/live_4.html" to "http://luigi.informatik.uni-mannheim.de/submit.php?action=verify". All files are then sent to CWSandbox and you will receive the reports in your inbox.

The latest SVN version of nepenthes is able to submit binaries to Norman and CWSandbox, just take a look at changeset 674.
This entry was posted by Thorsten Holz on Monday, October 23. 2006 at 20:30. and is filed under honeynets. You can leave a response, or trackback from your own blog. All new comments are subject to moderation before being displayed.

Trackbacks

Trackback specific URI for this entry

    No Trackbacks

Comments

Display comments as (Linear | Threaded)

    No comments


Add Comment


Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA
 
Submitted comments will be subject to moderation before being displayed.