Feature request: Download and run samples

[ctxis]

Feature request: Download and run samples

[kevoreilly]

I have been pondering this - my current plan is to make a 'wget' package which will run wget in the vm with the supplied url then the package will launch and monitor the result. Obviously this requires internet access for the windows hosts so for the moment this won't work on the public instance! But I do think it's important to route the download through the same internet connection as would be used for the target hosts, rather than using that of the server.

[redsand]

I agree with this strategy. It should be handled by the agent, imo

[kevoreilly]

Ok I have just pushed a new 'wget' package to allow this, along with a wget binary in 337e2a5.

You now can submit the malware URL in the URL bar, choose wget package and it should do the rest - it will attempt to download the URL via wget then launch the file.

There is one major limitation still: the file doesn't appear in static analysis. As it was downloaded by wget it's not properly registered in cape as the file 'of interest' - at some point it would be nice to complete this by getting the static analysis working too.

[doomedraven]

implemented here kevoreilly#154

[kevoreilly]

Thank you @doomedraven!