Yomi: a real-life sandbox architecture and implementation
summary
A Cuckoo-based sandbox implemented in Python with C modules exposes a public API and runs a pipeline that demoxes nested and passworded archives using John the Ripper and 7‑zip, stores tasks in MongoDB with a shared filesystem, and dispatches work to a VM pool (QEMU/libvirt) called machinery. An HTTP agent and result server collect artifacts while DLL injection and kernel‑driver hooking record API calls; auxiliary modules capture tcpdump/mitmproxy traffic, screenshots and a human bot. Signatures score 0–4 clean, 4–8 suspicious, >8 malware; it catches Follina-like msdt exploits by combining static and dynamic evidence.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:34What Is an Analysis Pipeline
- 4:56Scheduler
- 8:23Dynamic Analysis
- 10:00What Is the Guest
- 10:43Malware Evasion
- 11:39Common Evasion Techniques
- 19:03Parallelization
- 21:05Reporting Step
related talks
21mAutomating dynamic malware analysis
52mYou Gotta Keep the Dogs Away: YOLO Developer Workflows with a Coding Agent in a Box
28mFuzzing Malware for Fun & Profit
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
44mSlime: Automated Anti-Sandboxing Disarmament System
56mAutomating Linux Malware Analysis Using Limon Sandbox
23mMantra OS: Because The World is Cruel
24mDefeating the Transparency Feature of DBI