cosa-nostra - Cosa Nostra, a FOSS graph based malware clusteriza

项目说明

Cosa Nostra

Cosa Nostra is an open source software clustering toolkit with a focus on malware analysis. It can create phylogenetic trees of binary malware samples that are structurally similar. It was initially released during SyScan360 Shanghai (2016).

I basically maintain it since 2016 for my one and only user, who happens to be a friend... Well.

Getting started

Required 3rd party tools

In order to use Cosa Nostra you will need a of Python 3.X as well as one of the following tools in order to perform code analysis:

* IDA Written in C++. It supports analysing a plethora of executable types that you probably never e about. Commercial product. Only the 7.X are now supported.
* Radare2 Written in pure C. Same as with IDA, with support for extremely rare CPUs and binary formats. Also, it's open source!

Analysing binaries

Once you ha any of the pre mentioned tools you will need to use the appropriate batch tool to analyse the malware samples, like in the example bellow:

Or

Automating the Analysis of a Malware Dataset

The easiest way to analyse a malware dataset is by simply running a command like the following example:

It can be done in parallel by using the "GNU Parallel" tool, as in the following example:

In the example above, it will launch a total of 8 pyew_batch processes in parallel.

Database configuration

After the malware samples are analysed, if the analysis was successful, the call graph data for each sample will be stored in, by default, one SQLite database named "db.sqlite". You can configure the database name, path, database system, etc... by editing the file $COSA_NOSTRA_DIR/, as shown bellow:

If you prefer to use, say, a MySQL database system, you can configure it in config.cfg by putting the following configuration sections with the appropriate for your setup:

Clusterization of malware samples

This is the step that will take more time. Once you ha all the malware samples from your datasets and the call graph signatures, corresponding prime numbers, etc... are calculated and stored in the database, the next step is to find cluster. The tool for doing so is called "cn_clusterer.py". It will make use of the same database configuration file ($COSA_NOSTRA_DIR/config.cfg) in order to extract the call graph signatures for the analysed samples. Running it as simple as doing the following:

When the process finishes, clusters grouping the analysed malware samples will be created in the specified database.

Watching clusters: the web GUI

The last step is to launch the web.py based Web application and logging in:

Then, open a browser and na to the address printed out by cosa_nostra.py. A login form will be displayed asking for a username and password. By default, it's "admin/cosanostra". You can change it in the file $COSA_NOSTRA_DIR/config.py:

Once you're logged in you can select from the left panel one the following options:

* Samples: See the samples in the current database.
* Clusters: See the list of clusters that Cosa Nostra found for the gi.

In the "Clusters" view, one can select different clusters and view a hierarchical graph of the discovered malware family.

Screenshots

List of clusters as shown in Cosa Nostra:

!List of clusters as shown in Cosa Nostra

A small cluster of Trojan.Backspace-1 (name by ClamAV):

!A small cluster of Trojan.Backspace-1, name by ClamAV

A small cluster of MiniDukes:

!A small cluster of MiniDukes

A cluster of Kazy/Bifroses:

!A cluster of Kazy/Bifroses

A small part of a really big cluster of FannyWorms:

!A small part of a really big cluster of FannyWorms

项目信息

开发语言：Python

Star 数：231

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Cosa Nostra, a FOSS graph based malware clusterization toolkit.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。