Mike Sconzo sooshie

I hereby claim:

To claim this, I am signing this object:

	# Python 3
	# Sometimes hunting for strings in a bunch of different browser extensions and their many versions can be a pain.
	# This will call out to crxcavator.io, pull the versions and sources. Then just run a simple string match on it.
	# Surprisingly, it works.
	#
	# [email protected]


	import requests
	import json

	event file_sniff(f: fa_file, meta: fa_metadata)
	{
	if ( ! meta?$mime_type ) return;
	if ( meta$mime_type == "application/x-dosexec" )
	{
	local fname = fmt("%s-%s.%s", f$source, f$id, "._xe");
	Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename=fname]);
	}
	}

	{
	"packages":[
	{
	"name":"digistump",
	"maintainer":"Digistump",
	"websiteURL":"http://digistump.com",
	"email":"[email protected]",
	"help":{
	"online":"https://digistump.com/board"
	},

	#https://r3v3rs3r.wordpress.com/2015/12/12/unicorn-vs-malware/

	from unicorn import *
	from unicorn.x86_const import *
	from capstone import *
	from capstone.x86 import *
	import pefile
	import struct
	import string
	import sys

	While not definitive, this should hopefully give you a starting point in migrating from the initial/defalt sqlite setup for cuckoo to postgres.

	Postgres setup
	1) install postgres (apt-get install postgresql)
	2) install postgres dev (something like: apt-get install postgresql-server-dev-9.3)
	3) install psycopg2 (pip install psycopg2)
	4) login to postgres and create a user (I created 'cuckoo')
	5) create a database and give the user created in #4 rights to it (I created 'cuckoo' here as well)

	Migrate data

	scp -o ProxyCommand="ssh -A $user1@$host1 nc $host2 22" -r localdir/ $user2@$host2:/remote/directory
	ssh -A $user1@$host1 -t ssh $user2@$host2

	# Run this to create the buckets before using CRITS to store files.
	# Also don't forget to make sure the relevant info is in database.py
	python manage.py create_buckets

	#!/bin/bash

	set -e
	set -x

	if [ $# -ne 2 ]
	then
	echo "Wrong number of arguments supplied."
	echo "Usage: $0 <server_url> <deploy_key>."
	exit 1