CAPEv2 is a Python-based malware sandbox descended from Cuckoo that detonates suspicious files in isolated guests while automatically unpacking payloads and extracting malware configurations for authorized analysts.
| Tool | kevoreilly/CAPEv2 — malware sandbox derived from Cuckoo specializing in automated unpacking, YARA classification, and config extraction |
| Category | Dynamic malware analysis sandbox (Python) |
| Primary Use | Detonating malware samples in isolated Windows guests to capture behavioral telemetry, unpacked payloads, PCAP traffic, and extracted C2 configurations for defensive research |
| Safe Use | Strictly for authorized malware research, CERT/CSIRT triage, and lab environments; a free public demonstration instance exists at capesandbox.com for analysts without their own infrastructure |
| Telemetry Note | CAPE is a defensive instrument, not an attacker tool; it observes malware rather than facilitating it, producing PCAP, memory dumps, YARA hits, and parsed configs that feed threat-intel platforms |
kevoreilly/CAPEv2, standing for Config And Payload Extraction, is a malware sandbox forked from Cuckoo v1 and continuously hardened for nearly a decade by Kevin O'Reilly and a substantial contributor base — the repository shows roughly 3,495 stars, Python as the dominant language, and active development into 2026 with guest support for Windows 10 and Windows 11 23H2. At its core it executes suspicious files inside isolated virtual machines while instrumenting their behavior through API hooking, capturing created files, recording network traffic in PCAP format, taking desktop screenshots, and producing full memory dumps of the target. What distinguishes CAPEv2 from a generic sandbox is its singular obsession with two artifacts traditional sandboxes discard: the unpacked payload hidden inside packers, and the malware family configuration that encodes its operational parameters.
The lineage matters for understanding the architecture. The README recounts the 2015 fork of the Cuckoo project, when the original monitor was deprecated upstream and Brad Spengler's cuckoo-modified continued it with 64-bit support and a Visual Studio build chain. O'Reilly's original CAPE work at Context Information Security used Microsoft's Detours library for API hooking, but the team concluded hooks alone lacked the precision to unpack arbitrary malware. That insight produced the project's defining feature: a custom debugger that controls malware without touching Microsoft's debugging interfaces, deliberately avoiding the artifacts debuggers normally leave behind and thus remaining stealthy against anti-analysis checks.
This debugger is the technical heart of the platform. It is programmable at detonation time via dynamic YARA signatures — when a signature matches in memory, the sandbox can set breakpoints, dump regions, or manipulate control flow. The same mechanism powers dynamic countermeasures against anti-sandbox techniques such as timing traps for virtualization detection and API hook detection: the signature detects evasive code as it runs, and combined debugger actions force the sample to either detonate fully or skip its evasive branch. Recent additions extend this to 'syscall hooking' based on Microsoft Nirvana, direct and indirect syscall countermeasures, AMSI payload capture, and an interactive desktop for hands-on triage.
Automated unpacking operates in two modes. The 'passive' default exploits inherent malware behaviors — shellcode injection, DLL injection, process hollowing, process doppelganging, and in-memory decompression of executable modules — capturing anything injected, extracted, or decompressed before it does damage, plus an automatic process dump (or module image dump for DLLs) per process. The 'active' mode, enabled with submission option unpacker=2 or a web-interface tickbox, uses breakpoints on writes to newly allocated or protected memory to grab unpacked payloads before they execute; the README notes it is off by default because it can degrade detonation quality. For known packers like UPX, a custom YARA signature plus a breakpoint on the final packer instruction captures the payload at its original entry point (OEP), before a single malicious instruction runs.
Manual debugger control is exposed through submission options rather than an IDE. Breakpoints bp0 through bp3 accept RVA or VA values with count and depth parameters governing instruction traces, bp0=ep targets the module entry point, break-on-return=NtGetContextThread sets a breakpoint on a hooked API's return address, and base-on-api=NtReadFile,bp0=0x2345 anchors RVA breakpoints to a runtime image base. The action0–action3 options trigger behaviors on hit, such as dumpebx to dump a memory region or skip to alter control flow. The dump-on-api=DnsQuery_A option dumps a module when it calls a named API — a quick triage lever for analysts who know what a family does but not where its unpacking routine lives.
Classification runs on three parallel axes: YARA scans of the unpacked payloads, Suricata scans of network captures, and behavioral signatures over the API hook output stream. This triad is what makes the pipeline defensible in a report — a family attribution can be corroborated by memory content, network indicators, and runtime behavior simultaneously rather than resting on a single noisy signal.
Configuration extraction is the other headline capability, and the README is refreshingly honest about its fragility. CAPE's own parser framework is pure Python with a simple def extract_config(data): entry point invoked by cape_utils.py, deliberately free of framework lock-in so extractors port to other projects. External frameworks are supported if you prefer their ecosystems: RATDecoders, DC3-MWCP, MalDuck, and MaCo. The core and community parsers now live in the separate CAPE-parsers repository installed as a dependency, which isolates the constantly-breaking parser churn from the sandbox core. The README warns bluntly that because malware changes constantly, parsers will break with every new version — a maintenance reality every team adopting this must budget for.
The monitor that performs in-guest hooking, capemon, is maintained in its own repository (kevoreilly/capemon), which is a sensible split: guest-side components evolve on a different cadence than host orchestration. A community repository of signatures — several hundred contributed detections, bypasses, and parsers — feeds features upward into core once developers commit to maintaining them. The project also spawned CAPEsolo in 2024, an interactive Windows desktop variant using wxPython with 64-bit guest Python support, worth knowing about when a full distributed deployment is overkill.
Operationally, deployment expectations are specific: the host is tested with Python 3.10 and 3.12 on Ubuntu 24.04 LTS, while the in-guest agent.py requires x86 Python 3.7.2 or 3.8 — the README stresses using the 32-bit interpreter inside the VM regardless of guest architecture. Installer scripts kvm-qemu.sh and cape2.sh automate provisioning, with the sharp caveat that only rooter should run as root and everything else as the cape user, or file permissions will be corrupted. The README also insists operators read every file in the conf folder before going live, which is fair advice given how much behavior is tuned there.
Analysts without sandbox infrastructure can evaluate the platform through the free public instance at capesandbox.com (account activation via the project's Twitter presence) before committing to self-hosting — defanged here as hxxps://capesandbox[.]com. For defensive teams, CAPEv2 occupies a specific niche: it is the automation layer that turns a submitted sample into structured outputs — family classification, extracted config, unpacked binary, PCAP, memory dumps — that feed threat intelligence platforms and retro-hunting pipelines. Its design decisions, from the stealthy custom debugger to YARA-driven programming, all serve one goal: getting modern evasive malware to show its true payload inside a controlled, authorized lab, and that is exactly what it delivers.
kevoreilly/CAPEv2.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.