Cyberhunter Sandbox

A self-hosted, interactive and stealthy malware analysis sandbox, with no agent inside the analyzed machine. The analyst submits a file, a URL or an email, watches it run live in a disposable Windows VM, and gets a behavior report. Everything is observed from outside the VM, so the malware cannot see it.

Project status: under construction, but usable end to end.

What it is, and why agentless

Open source sandboxes (Cuckoo, CAPEv2, Cuckoo3) have two limits this project addresses.

The first is detectability. They install an agent in the analyzed VM to watch behavior. That agent (a process, a DLL, hooks) is visible, and modern malware looks for it. When it finds one, it goes to sleep and shows nothing. Even ANY.RUN, the commercial reference, relies on a visible guest agent.

The second is usability. Real-time interaction (seeing the screen, clicking, typing an archive password, getting through an installer) is either missing or an afterthought.

Cyberhunter aims for both: observation that is 100% external to the VM, so undetectable by design, and a smooth interactive session in the browser. Nothing that observes the malware lives in the VM:

The only Windows-side "code" is configuration: registry keys that turn on a native Windows ETW trace, never an executable that malware could enumerate as a monitor.

Architecture

Two planes are strictly separated. The control plane orchestrates but never touches the malware. The detonation plane runs the sample in a disposable VM, on a fully closed network where INetSim simulates the Internet. The only thing that crosses the boundary is the worker (running as root) that drives the hypervisor.

Technology stack

Changelog

No tagged releases yet. The log is organized by date (most recent first), then by infrastructure component. The matching commit hash is shown in parentheses.

2026-09-03

Introspection and analysis

Added

• Live kernel telemetry (ETW): processes with their command line and parent, DLL loads, file and registry activity, shown in a "System" tab. The trace comes from the Global Logger (the AutoLogger cannot capture NT Kernel Logger events), injected through the overlay into the SYSTEM hive, in circular mode. (7990e1b)
• Standalone, fast ETW parser (etwfast.py, about 7 s for 325 MB where etl-parser took about 2 min): a struct.unpack walker that decodes the Process/Image MOF structures as well as Registry v2 and File v3, which etl-parser lacks, rebuilt from the raw bytes of a real trace (including the Process version 4 trap, where the SID offset differs). Output focuses on the sample's process tree.
• Live persistence detection (write to a Run/Winlogon key, drop into a startup folder) mapped to MITRE ATT&CK T1547.001, with a dedicated verdict signal. Real ETW command lines also feed the execution and discovery rules.

Platform and interface

Added

• Search and history: free-text filter (name, sha256, URL, image, tag, verdict), verdict filter, editable tags per analysis and one-click re-analysis. The verdict level is copied to the database for sorting and display. (96fdb90)
• Visual redesign of the interface based on cyberhunter.fr: palette and background, real logo, circular verdict gauge, pill tabs, ATT&CK matrix as cards, analysis view with an expandable screen and a right column of boxes. Summary cards (activity, families) on the dashboard.
• PDF report fully redesigned in the Cyberhunter style (logo banner, colored verdict badge, sections, dark theme).
• Downloadable artifacts (PCAP, memory dump, dropped files, ETW traces) in a dedicated tab, with path traversal protection.
• Consolidated IOC panel (domains, IPs, URLs, C2, mutexes, persistence keys) with one-click copy and MITRE ATT&CK Navigator export.
• Threat intelligence enrichment of IOCs (VirusTotal, AbuseIPDB), strictly opt-in with API keys, on the control plane, never from the VM.

Detonation and collection

Added

• Detonation by file type: PE launched directly, scripts and documents through the matching native interpreter (wscript, powershell, mshta, rundll32, msiexec, associated handler for .lnk and Office), with an optional launch command override. (96fdb90)
• Phishing email analysis (.eml/.msg): the email is dissected outside the sandbox (sender, SPF/DKIM/DMARC, spoofing hints, links, attachments), then each attachment detonates and each link opens in the VM in one click. (96fdb90)

2026-09-02

Guest image and build

Added

• Image catalog (base/images.json + image/register-image.sh) and OS choice at submission, as on ANY.RUN. (3e0cf57)
• Generic build pipeline: the installed edition, VirtIO drivers and OS type become parameters, with the full procedure to add an OS (Windows 7/10/11, 32 or 64 bits). (ebba128)
• Second image built: Windows 10 x64 (hardened and registered in the catalog), alongside Windows 11.

Fixed

• autounattend compatibility with Windows 10: misplaced DriverPaths block removed (rejected by Windows 10) and mandatory quotes around the edition. (f170d39, 8fd114e)

Stealth (anti-evasion)

Added

• Continuous stealth measurement with Pafish (timestamped baselines), later extended to al-khaser (229 tests passed, 28 detected) and sandbox_detector (3 of 22). (b75f143)

Changed

• Hyper-V enlightenments removed: this drops the Microsoft Hv marker and brings Pafish from 12 to 11 detections. (f20e773)
• QEMU HARDDISK disk identifier replaced by a realistic SSD model, and the ACPI table OEM (BOCHS/BXPC) rewritten to LENOVO: Pafish from 11 to 9. (b75f143)

Fixed

• Windows Defender quarantined the sample; Defender services are disabled in the SYSTEM hive, because policy keys are not enough (Tamper Protection ignores them). (3d76ada)

Detonation, pool and collection

Added

• Detonation: disposable overlay backed by the frozen base, agentless sample injection (RunOnce key set offline), collection of the PCAP, screenshots, memory dump and dropped files. (3d76ada)
• Pool of pre-warmed VMs driven by the worker (POOL_SIZE): N machines already at the desktop, used hot as soon as a file arrives (no boot time, already high uptime), with a cold boot fallback. (74741ce)

Changed

• Hot delivery to the pool reworked: media change on a CD drive present from boot, instead of a hot-plugged USB disk whose drive letter did not reliably appear in the guest. (0bac3e9)

Fixed

• Dropped file collection made deterministic: clean ACPI shutdown before collection (with a forced stop fallback), so Windows flushes its write cache to disk instead of losing files. (5ec6c85)

Introspection and analysis

Added

• Post-mortem introspection with Volatility 3 on the dump, and above all a single event schema consumed by the whole pipeline. (4350367)
• YARA rules on dropped files and a verdict engine with a score explained signal by signal. (581da99)
• Configuration extraction: plugin framework, generic IOC extractors (f000d4d), then per-family parsers (Remcos, AsyncRAT/Quasar/DcRat/VenomRAT, njRAT) that recognize their family before extracting C2 and settings. (1efcc24)
• Live memory introspection (memflow): real-time parent-to-child process tree, through a standalone Rust binary (works around the ABI incompatibility of the Python bindings), with an automatically calibrated PPID offset. (81aad3c, 3b9dfb7)
• Richer network analysis: Suricata replays the PCAP offline and feeds the Network tab with IDS alerts (ET open rules), DNS queries, HTTP transactions and TLS (SNI). The worker now captures the PCAP too (only the CLI did before). (697cfe5)
• TLS interception: mitmproxy in transparent mode decrypts HTTPS. Its CA is imported into the root store of each overlay (registry, offline), and decrypted requests come back as https events. Enabled with TLS_MITM=yes. (76da679)
• Behavioral signatures and MITRE ATT&CK mapping: a rule engine maps events to techniques (Txxxx) and feeds an ATT&CK matrix by tactic, plus a dedicated tab. It improves readability without changing the score. (9e609fe)
• Instant static analysis: PE triage (pefile) at submission, then FLARE capa capabilities (ATT&CK-mapped) computed in the background. (3cd9757)

Changed

• The verdict tells a family configuration (strong signal) apart from plain generic IOCs (noisier). (1efcc24)

Platform and interface

Added

• Web platform: FastAPI API, detonation worker, database, submission and reports. (5dc5c73)
• Live VNC screen controllable in the browser, through a WebSocket bridge carried by the API (a single tunneled port, no external component). (298e3f5)
• React/Vite analyst interface: file drop, three-column view, process tree, timeline, screenshot replay, embedded VNC screen. (b0c58f4)
• Team mode: token accounts with owner_id, optional PostgreSQL and privilege separation (unprivileged API, worker as root) through systemd. (d0a04bc)
• OS selector and OS column in the interface, fed by the image catalog. (3e0cf57)
• URL submission (not only files): the URL opens in Edge in the guest (first-run screen bypassed), to analyze phishing and driven downloads. (e39bbad)
• Analysis exports: consolidated JSON report, PDF (reportlab), and an importable MISP event (IOC attributes + MITRE ATT&CK galaxy tags). (44cfba7)
• Static tab: PE triage (hashes, header, sections, notable imports, packing hints) then capa capabilities. (3cd9757)

2026-09-01

Host and network

Added

• KVM/QEMU + libvirt virtualization base, nesting validated on AMD (the VM really runs as type='kvm', not emulated). (504cf6c)
• Fully isolated analysis network (no route to the outside), INetSim answering in place of the Internet, and a firewall service that blocks cloud metadata and internal ranges from the bridge, without ever touching administration SSH. (504cf6c)

Guest image and build

Added

• Windows 11 image installed without interaction (autounattend), then hardened offline: ThinkPad SMBIOS, hypervisor bit masked, e1000e network card, ETW trace started at boot, and a "lived-in" profile (documents, downloads). (504cf6c)

Fixed

• Automatic BitLocker encryption of Windows 11 prevented at install time; otherwise the disk becomes unreadable offline (hardening, injection and introspection impossible). (504cf6c)

Documentation

Added

• Initial README (motivation, architecture, installation, pitfalls, glossary) and .gitattributes forcing LF line endings for identical replays on any machine. (6db7ac8, 8f49e15)