issue with installing CAPE

[ctxis]

issue with installing CAPE

[kevoreilly]

Hi there, I am sorry to hear you have had issues with the installation. It looks like a problem installing geoip with pip, but I can't say much more than that to help with your first question I'm afraid, other than to note that this requirement is part of the underlying Cuckoo (from spender-sandbox) in case that might be helpful. I would check all is well with pip, and then try and manually install that package, and perhaps approach its author(s) if you are unable to get past this.

As far as submitting PlugX samples, if I am right in thinking that by the 3 files you mean a signed exe, sideloaded dll and payload file, then all you need to do is zip them with their proper names, and submit to CAPE with the zip package. If they are PlugX, this should be detected and a subsequent job with the PlugX_zip package should be triggered, pulling the config and payload(s). You can skip the first automatic job and submit with PlugX_zip if you already know or suspect it's PlugX.

I hope this is helpful, please let me know if you have any further questions.

Kevin