{"id":21629660,"url":"https://github.com/harryr/cockatoo","last_synced_at":"2026-05-21T04:01:40.634Z","repository":{"id":86008546,"uuid":"59293150","full_name":"HarryR/cockatoo","owner":"HarryR","description":"Torified Cuckoo malware analyser in a Docker container with VirtualBox","archived":false,"fork":false,"pushed_at":"2017-05-10T15:31:58.000Z","size":102,"stargazers_count":2,"open_issues_count":1,"forks_count":1,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-01-24T23:27:21.646Z","etag":null,"topics":["cuckoo","docker","malware-analysis","tor","virtualbox","vmcloak"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/HarryR.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-05-20T12:39:06.000Z","updated_at":"2023-08-18T12:19:54.000Z","dependencies_parsed_at":"2023-03-04T21:30:59.244Z","dependency_job_id":null,"html_url":"https://github.com/HarryR/cockatoo","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/HarryR%2Fcockatoo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/HarryR%2Fcockatoo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/HarryR%2Fcockatoo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/HarryR%2Fcockatoo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/HarryR","download_url":"https://codeload.github.com/HarryR/cockatoo/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244306556,"owners_count":20431840,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cuckoo","docker","malware-analysis","tor","virtualbox","vmcloak"],"created_at":"2024-11-25T02:08:18.611Z","updated_at":"2026-05-21T04:01:35.613Z","avatar_url":"https://github.com/HarryR.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\t   _____           _         _              \n\t  / ____|         | |       | |                   )/_\n\t | |     ___   ___| | ____ _| |_ ___   ___       \u003c' \\\n\t | |    / _ \\ / __| |/ / _` | __/ _ \\ / _ \\      /)  )\n\t | |___| (_) | (__|   \u003c (_| | || (_) | (_) |  ---/'-\"\"---\n\t  \\_____\\___/ \\___|_|\\_\\__,_|\\__\\___/ \\___/ \n\t                                            \n\nThis Docker-ized distribution of Cuckoo 2.0 should make it easy to run Cuckoo and create virtual machines for analysis with `vmcloak`. Tor is used to retrieve malware samples with `maltrieve`, all traffic from the analysis VMs is also routed through Tor.\n\n\n### Features\n\n * Cuckoo 2.0\n * vmcloak\n * maltrieve\n * VirtualBox inside Docker\n * X11 pass-through for testing\n\n\n## Getting Started\n\nOn an Ubuntu x86_64 machine: checkout the source, install the prerequesite packages and then build the containers with:\n\n\tsudo apt-get install make git\n\tgit clone https://github.com/HarryR/cockatoo --recursive\n\tmake -C cockatoo prereq  # uses sudo\n\n\t# In /etc/default/docker - modify DOCKER_OPTS:\n\t# DOCKER_OPTS=\"--storage-driver=devicemapper\"\n\tsudo service docker restart\n\n\t# Then make sure your user is a member of the 'docker' and 'vboxusers' group\n\t# e.g.: gpasswd -a $USERNAME docker\n\t# e.g.: gpasswd -a $USERNAME vboxusers\n\n\tmake -C cockatoo build run-cuckoo\n\nThe full build process will take 10 minutes to an hour+ depending on your\ninternet, cpu and disk speeds etc. Assuming everything goes well you will have everything necessary to build guests, run Cuckoo and start analysing malware.\n\nWhen running Cuckoo the `VIRTUALBOX_MODE` option can be used to show or hide \nthe VirtualBox GUI.\n\n\tVIRTUALBOX_MODE=gui make -C cockatoo run-cuckoo\n\n\nTo start after a reboot, create crontab entries:\n\n```crontab\n# m h  dom mon dow   command\n  0 *  *   *   *     make -C /srv/cockatoo archive\n@reboot              screen -d -m -S maltrieve make -C /srv/cockatoo run-maltrieve\n@reboot              screen -d -m -S cuckoo make -C /srv/cockatoo run-cuckoo\n\n```\n\n\n## Useful Links\n\n * http://vmcloak.org/\n * https://www.cuckoosandbox.org/\n * http://deaddrop.threatpool.com/vmcloak-how-to/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fharryr%2Fcockatoo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fharryr%2Fcockatoo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fharryr%2Fcockatoo/lists"}