ph0neutria - ph0neutria is a malware zoo builder that sources s

项目说明

ph0neutria #

**ph0neutria malware crawler
v1.0.1

Note: This project is not actively maintained.

About ###

ph0neutria is a malware zoo builder that sources samples straight from the wild. E is stored in Viper for ease of access and manageability.

This project was inspired by Ragpicker ( formerly known as "Malware Crawler"). However, ph0neutria aims to:

Limit the scope of crawling to only frequently updated and reliable sources.

Maximise the effecti of indi indicators.

Offer a single, reliable and well organised storage mechanism.

Not do work that can instead be done by Viper.

What does the name mean? "Phoneutria nigri" is commonly known as the Brazillian Wandering Spider:

Sources ###

As of 1.0.0 all sources are created as 'plugins', found in the plugin sub-directory of the core scripts folder. Default sources are:

0xffff0800's Malware Library (credit: ).

CleanMX (requires appro).

Cymon, which includes: Abuse.ch trackers, Bambenek C2 feed, Cyber Crime Tracker, Malc0de, URLVir and .

Hybrid Analysis (requires API key).

OTX.

Shodan, using the Malware Hunter search facility.

URLhaus.

Each plugin has parameters that must be completed prior to operation. You'll find these at the top of each plugin file.

is a core component of ph0neutria that cannot be disabled. IP lists are fed into it to discover URL's that are known for the IP's. If you have a standard 5 request/minute API key then I'd encourage being conser with what you feed it. You can do this by:

Reducing the number of Cymon feeds.

Reducing your OTX subscription count.

Setting the Hybrid Analysis SCORE_MIN parameter to 100.

Screenshots ###

!CLI
!CLI
!CLI
!Web
!Web
!Web

Notes ###

0.6.0: Tor proxying requires pysocks (pip install pysocks) and at least 2.10.0 of python requests for SOCKS proxy support.

0.9.0: OSINT functionality pulled from Phage Malware Tracker (private project) - requires API key. More robust retrieval of wild files. Local URL and hash caching (reduces API load).

0.9.1: Updated to use V3 Viper API. No longer compatiable with V2.

1.0.0: Major update. Pull from Safari Guide malware pipeline. Plugin architecture. Python 3.0.

1.0.1: Source update (added 0xffff0800's library). Samples can now be tagged with sourced classification.

Installation ###

The following script will install ph0neutria along with Viper and Tor:

Simple as that!

#### Optional: ####
Configure additional ClamA:

Rename os.<yourdistro>.conf to os.conf, for example:

Modify configuration files:

master.conf: search for "Enabled Databases" and enable/disable desired sources.

user.conf: uncomment the required lines for sources you ha and complete them. user.conf o master.conf. You must uncomment user_configuration_complete="yes" once you' setup for the following commands to succeed.

For more configuration info see:

It'll take a while to pull down the new signatures - during which time ClamAV may not be a.

Usage ###

Take precautions when piecing together your malware zoo:

Do not disable Tor unless replacing with an anonymous VPN.

Operate on an isolated network and on dedicated hardware.

Only execute samples in a suitable Sandbox (refer: ).

Monitor for abuse of your API keys.

Ensure Tor is started:

service tor restart

Start the Viper API and web interface:

Take note of the admin password that is created when Viper is started. Use this to log into IP\>:<viper port>/admin (default: ) and retrieve the API token from the Tokens page.

The main Viper web interface will be a at IP>:<viper port> (default: ).

Complete the config file at: /opt/ph0neutria/core/config/settings.conf

Complete the parameters at the top of each plugin. If you wish to disable the plugin, set DISABLED = True: /opt/ph0neutria/core/plugins/*.py

Start ph0neutria:

You can press Ctrl+C at any time to kill the run. You are free to run it again as soon as you'd like - you can't end up with database duplicates.

To run this daily, create a script in /etc/cron.daily with the following:

Tags and Notes ###

Tags:
{1},{2},{3}

Date stamp.

Sample domain.

Host ASN.

Host country.

Notes:
{1)({2}) via {3}

Sample URL.

Host IP address.

URL source.

The original name of the file forms the identifying name within Viper.

References ###

Cymon API documentation.

- Hybrid Analysis API documentation.

- MalShare API documentation.

- AlienVault OTX API documentation.

- URLhaus API documentation.

- Shodan API documentation.

- Viper API documentation.

- API documentation.

项目信息

开发语言：Python

Star 数：301

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕ph0neutria is a malware zoo builder that sources samples straight from the wild. Everything is stored in Viper for ease of access and manageability.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。