在 Cuckoo Sandbox 中引爆恶意软件样本以观察其运行时行为——包括进程创建、文件系统与注册表变更、网络通信以及 API 调用——并生成用于分类与 IOC 提取的行为报告。适用于样本已通过静态分流（static triage）并需要进行动态/行为分析、构建完整感染链映射、或基于沙箱观测活动构建 YARA/行为签名等场景。
A suspicious sample passed static analysis triage and requires behavioral observation in a controlled environment
You need to capture network traffic, file drops, registry modifications, and API calls from a malware execution
Determining the full infection chain including second-stage payload downloads and persistence mechanisms
Generating behavioral signatures and YARA rules based on observed runtime activity
Automated analysis of bulk malware samples requiring consistent reporting
Do not use when the sample is a known ransomware variant that may spread via network shares in a misconfigured sandbox; verify network isolation first.
Prerequisites
Cuckoo Sandbox 3.x installed on a dedicated analysis server (Ubuntu 22.04 recommended)
Guest VMs configured with Windows 10/11 snapshots (Cuckoo agent installed, snapshots taken at clean state)
VirtualBox, KVM, or VMware configured as the Cuckoo virtualization backend
Isolated network with InetSim or FakeNet-NG for simulating internet services
Suricata or Snort integrated for network-level signature matching during analysis
Sufficient disk spac…
以下为摘要预览，完整内容请查看 GitHub 原文。
Analyzing Malware Behavior with Cuckoo Sandbox
When to Use
A suspicious sample passed static analysis triage and requires behavioral observation in a controlled environment
You need to capture network traffic, file drops, registry modifications, and API calls from a malware execution
Determining the full infection chain including second-stage payload downloads and persistence mechanisms
Generating behavioral signatures and YARA rules based on observed runtime activity
Automated analysis of bulk malware samples requiring consistent reporting
Do not use when the sample is a known ransomware variant that may spread via network shares in a misconfigured sandbox; verify network isolation first.
Prerequisites
Cuckoo Sandbox 3.x installed on a dedicated analysis server (Ubuntu 22.04 recommended)
Guest VMs configured with Windows 10/11 snapshots (Cuckoo agent installed, snapshots taken at clean state)
VirtualBox, KVM, or VMware configured as the Cuckoo virtualization backend
Isolated network with InetSim or FakeNet-NG for simulating internet services
Suricata or Snort integrated for network-level signature matching during analysis
