Build Automated Malware Lab with CERT.pl Open-Source Software
summary
Central malware lab that stores files, structured configurations and text blobs is live as MWDB with a public service at mwdb.cert.pl and open-source components on GitHub. A microservice pipeline called Carton runs sandboxing, memory dumps and family-specific extractors; mald provides reusable Python extractors. The instance has over 1,000 accounts, ~130 family modules (many unmaintained), real-time botnet tracking integrations and a proof‑of‑concept API/vector and disassembly‑reuse similarity engine.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:43We are in threat intelligence business
- 4:35Evolution of our malware tooling
- 7:29Basic ingredients of malware analysis lab
- 8:11Main components of our lab
- 8:56What is MWDB Core?
- 11:09MWDB: Configurations
- 13:28Basic processing pipeline
- 17:01Metadata: attributes
- 19:38Karton design
- 22:56Example: consumers of Office documents
- 26:08Statistics
- 27:31Working with the community
- 28:45Finding similar samples
- 30:10Using Windows API for classification
- 32:21Upcoming integration: msource
- 35:12Online training materials
- 35:37mwdblib: automation library for MWDB
- 35:49malduck: supports malware analysis
related talks
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
22mMalware Hunting - Using python as an attack weapon
36mMy CERT PL – Free Security Tools for Everyone (in Poland)
56mAutomating Linux Malware Analysis Using Limon Sandbox
47mDetecting and analyzing files-less malware
46mLiving off the Cloud: A Server-Free Approach to Malware Ops
41mBuilding Your Own Malware Sandbox
33mBasic Malware Analysis for Incident Responders