aleph - An Open Source Malware Analysis Pipeline System

项目说明

Aleph - OpenSource /Malware Analysis Pipeline System

![Join the chat at ]()

What?

Aleph is designed to pipeline the analysis of malware samples. It has a series of collectors that will gather samples from many sources and shove them into the pipeline. The sample manager has a series of plugins that are ran against the sample and returns found data into JSON form.

These JSON data can be further processed and queried in a objecti instead of *grepping and regexing*.

How?

The main Aleph daemon is a loose-coupled python application and library. These are composed by the Aleph Service that spawns:

1. The Collectors. These are responsible for going to multiple sources (Filesystem folder, IMAP folder, FTP directory etc) and collect all the files there, store locally and add them to the processing queue. Each collector runs in its own process (fork).
2. Multiple (quantity is configurable) parallel SampleManager services (that will pull samples from the work queue and process them) and run the plugins that receives the sample path and return the JSON object of found artifacts.
3. The sample object is con to JSON along with its data and is stored into an Elasticsearch backend.

Installing Aleph

Requirements

In order to get a clean and nice install, you should download some requirements:
Ubuntu/Debian

apt-get install python-pyrex libffi-de python-dateutil libsqlite3-dev

#### ElasticSearch
First if you don't have an Elasticsearch instance ready, you must install one.

For Debian/Ubuntu/Redhat/Fedora/CentOS (yum + apt basically) users, follow this guide.

Remember: Elasticsearh uses JVM, so you also must install it =)

#### Python modules
We strongly suggest that you use python's en so you don't pollute the rest of your OS installation with python modules. To make a contained en, install _ with _pip_:

pip install

Go to the desired Aleph installation folder and type the following to create and activate your en:

venv # 'venv' can be any name
source venv/bin/activate

There will be the en name (ven to your PS1 :

(ven 17:36:%)(~/opt/aleph/)

All python modules required are listed on the _requirements.txt_ file on the root repository folder. You can install all of them at once using _pip_:

pip install -r requirements.txt

Then clone the repository and copy the settings file:

git clone --branch aleph-python --single-branch .
cp aleph/settings.py.orig aleph/settings.py

Edit settings.py and add a local source (a folder where Aleph will search for samples - WARNING: ALEPH WILL MOVE THE SAMPLE THUS REMOVING FROM THE ORIGINAL FOLDER) _The folder must exists as Aleph won't try to create them_

SAMPLE_SOURCES = [
('local', {'path': '/opt/aleph/unprocessed_samples'}),
]

Review your Elasticsearch installation URI

ELASTICSEARCH_URI = '127.0.0.1:9200'

Workaround step
As I still finish some of the code, there are some folders that are not on the repository and must be created manually and set accordingly on the *settings.py* file:

SAMPLE_TEMP_DIR = '/opt/aleph/temp'
SAMPLE_STORAGE_DIR = '/opt/aleph/samples'

Remember to folders permissioning.
And Aleph is ready to run!

#### Running
Go to Aleph folder, activate the en and run the bin/aleph-server.py as following:

cd /opt/aleph/
source venv/bin/activate
./bin/aleph-server.py

And that's it. Check your logs under log/aleph.log to any troubleshooting.

#### Install the Web interface(Webui)
Edit the "SER" constant at your settings.py file.
ex: SER = 'mydomain.com:90'

then create the following entry:

SECRET_KEY = 'Pu7s0m3cryp7l337here' #do not use this ;)
SAMPLE_SUBMIT_FOLDER= '/some/path' #where samples will be submitted from webui

Setup your database:

python bin/db_create.py

Run the webui script:

bin/aleph-webui.sh

To access your webinterface open your fa browser at #That value you changed before.

Login: admin
Password: changeme12!

Note: For sake of Security's God, CHANGE YOUR PASSWORD! ;)

But if you do not like our webinterface you still can use other softwares to review and query data on elasticsearch. I strongly suggest this Chrome REST client plugin or the great Kibana

#### Currently implemented
Collectors
* FileCollector: grabs samples from a local directory
* MailCollector: grabs samples from email attachments on a IMAP folder

Plugins
* PEInfo : extracts info from PE files such as entrypoint, number of sections and some PE characteristics(SEH/ASLR/DEP).
* ZipArchi: extracts zip files and puts their contents back into analysis queue.
* StringsPlugin: extracts strings from sample into three categories: All Strings, URI Strings and Filename Strings (not 100% but we do our best).
* : check a sample SHA256 hash against database and get the report. If that hash doesnt exist, send the file to analise.
* TrID: check the filetype of a sample.

项目信息

开发语言：CSS

Star 数：158

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An Open Source Malware Analysis Pipeline System展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。