hpe-appliedsecurityresearch/maltese

Maltese - Malware Traffic Emulator

Maltese (Malware Traffic Emulating Software)

Maltese is a tool that is used to emulate malicious traffic generated by a given malware.

Developed using Python 3.4.3

##Maltese Command line options ####Root commands

usage: maltese.py [-h] {dga,replay} ...

optional arguments:
  -h, --help    show this help message and exit

commands:
  {dga,replay}
    dga         Execute DGA plugins
    replay      Execute Replay plugins

####DGA options

usage: maltese.py dga [-h] -p {necurs,sampledga} [-l {error,warning,info,debug}]

optional arguments:
  -h, --help                        show this help message and exit
  -l {error,warning,info,debug}     Logging level. Default is error

required arguments:
  -p {necurs,sampledga}             DGA Plugin module to run

####Replay options

usage: maltese.py replay [-h] -p {list,pcap} -i INPUT
                      [-l {error,warning,info,debug}]

optional arguments:
  -h, --help            show this help message and exit
  -l {error,warning,info,debug}
                        Logging level. Default is error

required arguments:
  -p {list,pcap}        Replay Plugin module to run
  -i INPUT              Input file for replay.

For details about various ways to evaluate a malware detector, please check out http://hpe.to/6047B7R0R

maltese's Issues

No traffic generated

when i run the following (first having created a dga list with maltese)
python3 maltese.py replay -p list -i list.txt

it doesn't not generate any traffic, don't see anything going over the wire... don't get any errors either. Am i missing something?

Many Thanks,
Luk

Security of Maltese

Hi there,
I have downloaded maltese to a Raspi to simulate an IoT device being infected by malware. If I set the dryrun option to false and run the dga option, will the code try to connect to all those domains? Does maltese pose any risk to my network?