merces/aleph

An Open Source Malware Analysis Pipeline System

Hello, stranger! 👋

So, you found me.

• 🔭 I’ve spent the past 10 years working as a threat researcher in Trend Micro.
• 💚 I run a non-profit organization called Mente Binária to educate people in computing.
• ⚡ Fun fact: I play guitar.

Things I love

Recent Publications ✍️

• How BPF-Enabled Malware Works: Bracing for Emerging Threats
• Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant
• Detecting BPFDoor Backdoor Variants Abusing BPF Filters
• Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals
• DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework
• Defending NAS Devices Against Evolving Threats
• Modern Ransomware's Double Extortion Tactics and How to Protect Enterprises Against Them
• VirusTotal Now Supports Trend Micro ELF Hash
• Grouping Linux IoT Malware Samples With Trend Micro ELF Hash
• VPNFilter Two Years Later: Routers Still Compromised

---

📊 Github Stats

aleph's Issues

Having problems to log in

When installing Aleph some users may skip the step of creating a SECRET KEY into settings.py. And creating the SQLlite database first, when this occurs users can't correctly login in the webinterface.

Check submitted samples consistency on WebUI

If we delete the sample entry directly from ES, it will persist on the WebUI DB and will throw an 404 ES error.

Need to remove from WebUI DB and warn user (flash message) that it has been deleted due inconsitency within ES db.

Create Cuckoo sandbox plugin

Create a Cuckoo sandbox plugin to send samples and receive Cuckoo reports. This should help us to better understand dynamic samples behavior.

Add URL extractor plugin

Must depend on strings plugin. Will get strings['url'] entry and add them as samples

Log in Issue

Not sure if anyone will see this since this project hasn't been active in a while...

I setup Aleph and everything seems to be fine but I cannot log into the web interface. The screen reloads and nothing happens. Not sure if its my config or what. I tried chmoding all files in webui but still having the issue.

Check configuration sanity on startup

Verify all configuration parameters on main aleph server and its plugins. Fail gracefully if not conformant.

Create tests for ziparchive plugin

@merces, please provide a ZIP file we can use to test (if possible, one second file with the unicode problem also).

Improve search

When we search for any string in the "Search" field (left sidebar) does not bring any results.

Support mach-o files

Create plugin with support mach-o file (OSX)

https://pythonhosted.org/macholib/

Add python-pip on readme.md

Add python-pip on readme.md, in:

Requirements

In order to get a clean and nice install, you should download some requirements: Ubuntu/Debian

apt-get install python-pyrex libffi-dev libfuzzy-dev python-dateutil libsqlite3-dev

Automatically create directories if needed

Verify if some local source at SAMPLE_SOURCES does not exists and create it automatically.

Create director component to requeue / rescan pending/ failed samples

Create director in order to check samples marked as queued that are not in queue and re-add them. Also make Web UI change sample status in order to be requeued by the director.

Add docstrings to the main classes/methods

The current code does not have any docstrings. We should add at least to the main classes/methods (specially to the plugins).

Change MailCollector to get .eml instead of attachments

create_sample must be primed in order to support "mimetype" argument in order to skip magic verification and set the mimetype manually in order to support the .eml and .url mimes that are not detected by magic.

User Management

Allow reset password without the prior knowledge of the password using a credential with administrative privilege, or allow the reset is made by the user by registered mail.
Allow delete user inserted into the system, keeping the items submitted by him

Error import samples by directory unprocessed

I put many samples in directory /opt/aleph/unprocessed ... aleph processed all the files but when I open web interface many samples stay with status "samples in queue" a long time ago.

How can I see whats files stay with status and how can I processed this?

Another questions if I put the same sample (same hash) why aleph do? he processed again and put in database or deleted the last samples?

Create gh-pages branch with simple homepage

Add to the website:

• General information about the project
• Add printscreens of Web UI
• Add code architecture image ("package" generated by pyreverse)

Fix Strings plugin

Better handling of Unicode data, review regexes (URI, FILE etc)

Register (and pay) project domain name

Also decide which domain we're going to use.
Should it be aleph.org?

Create URL parser plugin

Get information from given URL sample. Work only on url mimetypes

Check if SAMPLE_SUBMIT_FOLDER is not None when allowing file submissions

As reported by Alfredo Oliveira over Skype

Create tests for rararchive plugin

@merces, please provide a sample. =)

Fail sample analysis gracefully

Mark sample status as failed. Do not let sample manager crash or make him restart gracefully

Create tests for peinfo plugin

@merces, we need some sample files with known output from peinfo.py

Create tests for urlextractor and urlparser plugins

Instalação

Ola Merces !
Você tem a documentação do Aleph ? Estou com dificuldades para a instalação. Logo após a extração do arquivo com o bunzip -d ele deve gerar qual/quais arquivos ?

Obs.: Fiz um treinamento de analise de malware com voce, pela TM. Estou usando o PEV intensamente. Obrigado

Create config option to display only current user samples on main listing

As requested by Alfredo Oliveira.

Deploy a private demo instance (will be used for tests)

• Deploy the new version (maybe 0.1.1)
• Add link to the website

Create Mail plugin

Parse .eml files metadata and extract attachments (and create samples from them)

Create scripts to automate deployment

Options to use (instead of plain shell scripts):

• fabric
• docker

Create timestamps per status / enable sample history

Decide a way to track sample history. Timestamps for when sample was collected, queued, processed and stuff.

Create tests for strings plugin

@merces, please provide a sample. =)

Change link of ElasticSearch

Actually the link of ElasticSearch on Readme.md points to:

https://github.com/trendmicro/aleph/blob/master/www.elasticsearch.org

We have to change to:

www.elasticsearch.org

Igor Rincon

Create tests for email plugin

@merces, please provide a sample. =)

Add filtering / sorting to webui Sample list

Update README with latest info

Create tests for virustotal plugin

@merces, we need a sample to implement these tests. =)

Change link of ElasticSearch

Actually the link of ElasticSearch on Readme.md points to:

https://github.com/trendmicro/aleph/blob/master/www.elasticsearch.org

We have to change to:

www.elasticsearch.org

Storing the samples

Hi,

I was thinking in save the samples in a separate directory, based in your sha256, similar to project VxCage (https://github.com/neriberto/vxcage/blob/master/utils.py#L33).

What do you think about it guys?

Fix Strings plugin regexes

Getting crap from URI resolvers. Drop URI to URL or add URL support

Permit force mimetype and skip auto magic mime detection on Sample class

Requirement for .eml and .url files issues

Bug in webui with large paging numbers

When it has many pages, the paging system shows all out, what hinders navigation between pages.

Email plugin - Extract files in body message

Create a new feature in email plugin for download files in body message.

Project dead? Need takeover?

Just want to know if this is officially dead. If so, is it deprecated in favor of another project? Is it just lack of developers / time? is there anything the community can do to help?

The initial concept here has really solid potential and I'd hate to see it just disappear to time on GitHub. Lmk how I can help!

CC:
@merces @jseidl @turicas

Create security tests (and fix them) for Web UI