https://github.com/gosecure/malware_investigation_template
Because .idb files should be version controlled.
https://github.com/gosecure/malware_investigation_template
Last synced: over 1 year ago
JSON representation
Because .idb files should be version controlled.
- Host: GitHub
- URL: https://github.com/gosecure/malware_investigation_template
- Owner: GoSecure
- Created: 2016-06-06T20:38:10.000Z (about 10 years ago)
- Default Branch: master
- Last Pushed: 2016-07-13T18:19:08.000Z (about 10 years ago)
- Last Synced: 2025-04-05T15:35:29.596Z (over 1 year ago)
- Language: Shell
- Size: 2.93 KB
- Stars: 4
- Watchers: 3
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.adoc
Awesome Lists containing this project
README
= Malware Investigation Template
Because `.idb` files should be version controlled.
== Warning
Large binary files like `pcap` files don't belong in git. The repository will
slow down once it reaches a few gigabytes. To avoid pushing `pcap` files by
mistake the `pcaps/` directory is ignored in `.gitignore`.
== Starting an investigation
1. Fork this repository using github or via command-line (specify
investigation name):
+
git clone https://github.com/GoSecure/malware_investigation_template.git Win32.Bad.A
cd Win32.Bad.A
+
2. Configure where the `pcaps` will be rsync'ed
+
echo 'PCAP_DST=' > .config.sh
+
3. Get rid of original `.git` metadata and initialize new git tree
+
rm -r .git/
git init
Voilà!
NOTE: Forks of public repositories can't be made private on github. It is
advised to use the command-line and push to a private repo if you plan on
hosting your analysis on github.
== Usage
=== Pcaps
A helper script has been provided to sync `pcap` files. Simply use `push`
command to send files and `pull` to receive the files.
For example:
$ src/helpers/pcaps.sh push
=== Integration with malboxes
// TODO
Coming soon...
== License
I don't think this is copyright'able because it is just a bunch of directory
names, some documentation and a small script but just in case, here we go:
Under CC0 license: https://creativecommons.org/publicdomain/zero/1.0/
To the extent possible under law, GoSecure Inc. has waived all copyright and
related or neighboring rights to this repository's content.
== Contribute
Contributions to this template are welcome!