mirror of
https://github.com/cuckoosandbox/cuckoo.git
synced 2026-10-11 21:59:53 +00:00
165 lines
4.8 KiB
Plaintext
165 lines
4.8 KiB
Plaintext
# Enable or disable the available processing modules [yes/no].
|
||
# If you add a custom processing module to your Cuckoo setup, you have to add
|
||
# a dedicated entry in this file, or it won't be executed.
|
||
# You can also add additional options under the section of your module and
|
||
# they will be available in your Python class.
|
||
|
||
[analysisinfo]
|
||
enabled = yes
|
||
|
||
[apkinfo]
|
||
enabled = no
|
||
# Decompiling dex files with androguard in a heavy operation. For large dex
|
||
# files it can really take quite a while - it is recommended to limit to a
|
||
# certain filesize.
|
||
# decompilation_threshold=5000000
|
||
|
||
[baseline]
|
||
enabled = no
|
||
|
||
[behavior]
|
||
enabled = yes
|
||
|
||
[buffer]
|
||
enabled = yes
|
||
|
||
[debug]
|
||
enabled = yes
|
||
|
||
[droidmon]
|
||
enabled = no
|
||
|
||
[dropped]
|
||
enabled = yes
|
||
|
||
[dumptls]
|
||
enabled = yes
|
||
|
||
[googleplay]
|
||
enabled = no
|
||
android_id =
|
||
google_login =
|
||
google_password =
|
||
|
||
[memory]
|
||
# Create a memory dump of the entire Virtual Machine. This memory dump will
|
||
# then be analyzed using Volatility to locate interesting events that can be
|
||
# extracted from memory.
|
||
enabled = no
|
||
|
||
[misp]
|
||
enabled = no
|
||
url =
|
||
apikey =
|
||
|
||
# Maximum amount of IOCs to look up (hard limit).
|
||
maxioc = 100
|
||
|
||
[network]
|
||
enabled = yes
|
||
|
||
# Allow domain safelisting
|
||
safelist-dns = no
|
||
|
||
# Allow DNS responses from your configured DNS server for safelisting to
|
||
# deactivate when responses come from some other DNS
|
||
# Can be also multiple like : 8.8.8.8,8.8.4.4
|
||
allowed-dns =
|
||
|
||
[procmemory]
|
||
# Enables the creation of process memory dumps for each analyzed process right
|
||
# before they terminate themselves or right before the analysis finishes.
|
||
enabled = yes
|
||
# It is possible to load these process memory dumps in IDA Pro through the
|
||
# generation of IDA Python-based script files. Although currently symbols and
|
||
# such are not properly recovered, it is still nice to get a quick look at
|
||
# specific memory addresses of a process.
|
||
idapro = no
|
||
# Extract executable images from this process memory dump. This allows us to
|
||
# relatively easily extract injected executables.
|
||
extract_img = yes
|
||
# Delete process memory dumps after analysis to save disk space.
|
||
dump_delete = no
|
||
|
||
[procmon]
|
||
# Enable procmon processing. This only takes place when the "procmon=1" option
|
||
# is set for an analysis.
|
||
enabled = yes
|
||
|
||
[screenshots]
|
||
enabled = no
|
||
tesseract = /usr/bin/tesseract
|
||
|
||
[snort]
|
||
enabled = no
|
||
# Following are various configurable settings. When in use of a recent 2.9.x.y
|
||
# version of Snort there is no need to change any of the following settings as
|
||
# they represent the defaults.
|
||
#
|
||
# snort = /usr/local/bin/snort
|
||
# conf = /etc/snort/snort.conf
|
||
|
||
[static]
|
||
enabled = yes
|
||
# On bigger PDF files PeePDF may take a substantial amount of time to perform
|
||
# static analysis of PDF files, with times of over an hour per file estimated
|
||
# in production. This option will by default limit the maximum processing time
|
||
# to one minute, but this may be adjusted accordingly. Note that if the timeout
|
||
# is hit, no static analysis results through PeePDF will be available.
|
||
pdf_timeout = 60
|
||
|
||
[strings]
|
||
enabled = yes
|
||
|
||
[suricata]
|
||
enabled = no
|
||
# Following are various configurable settings. When in use of a recent version
|
||
# of Suricata there is no need to change any of the following settings as they
|
||
# represent the defaults.
|
||
#
|
||
# suricata = /usr/bin/suricata
|
||
# conf = /etc/suricata/suricata.yaml
|
||
# eve_log = eve.json
|
||
# files_log = files-json.log
|
||
# files_dir = files
|
||
#
|
||
# Uncommenting the following line makes our processing module use the socket
|
||
# mode in Suricata. This is quite the performance improvement as instead of
|
||
# having to load all the Suricata rules for each time the processing module is
|
||
# ran (i.e., for every task), the rules are only loaded once and then we talk
|
||
# to its API. This does require running Suricata as follows or similar;
|
||
# "suricata --unix-socket -D".
|
||
# (Please find more information in utils/suricata.sh for now).
|
||
# socket = /var/run/suricata/cuckoo.socket
|
||
|
||
[targetinfo]
|
||
enabled = yes
|
||
|
||
[virustotal]
|
||
enabled = yes
|
||
# How much time we can wait to establish VirusTotal connection and get the
|
||
# report.
|
||
timeout = 60
|
||
# Enable this option if you want to submit files to VirusTotal not yet available
|
||
# in their database.
|
||
# NOTE: if you are dealing with sensitive stuff, enabling this option you could
|
||
# leak some files to VirusTotal.
|
||
scan = 0
|
||
# Add your VirusTotal API key here. The default API key, kindly provided
|
||
# by the VirusTotal team, should enable you with a sufficient throughput
|
||
# and while being shared with all our users, it shouldn't affect your use.
|
||
key = a0283a2c3d55728300d064874239b5346fb991317e8449fe43c902879d758088
|
||
|
||
[irma]
|
||
enabled = no
|
||
# IRMA @ github : https://github.com/quarkslab/irma
|
||
# How much time we can wait to establish IRMA connection and get the report.
|
||
timeout = 60
|
||
# Enable this option if you want to submit files to IRMA not yet available.
|
||
scan = no
|
||
# Force scan of submitted files
|
||
force = no
|
||
# URL to your IRMA installation
|
||
# For example : https://your.irma.host
|
||
# url=
|