Datasetpublic

Vedaang/malware_analysis

Malware Analysis Dataset This dataset contains memory forensics analysis data for malware research, including both benign and ransomware samples analyzed with Volatility Framework. Structure Dataset Repository (this repo) Scripts: Volatility automation scripts (Automating_Volatility.py, Volshell_Automation.py, vboxelf.py) YARA Rules: malware_rules.yar for malware detection Scan Results: Lightweight analysis outputs: malfind/ - Process memory… See the full description on the dataset page: https://huggingface.co/datasets/Vedaang/malware_analysis.

sourceHugging Faceupdated 1mo agoView on Hugging Face

0likes38downloads

rootAutomating_Volatility.py

Automating_Volatility.py62 linesDownload Raw Back to root

1#!/usr/bin/env python32import subprocess3import os4 5rootdir = './'6file_name=[]7sub_dir=[]8 9for subdir, dirs, files in os.walk(rootdir):10    for file in files:11        file_name.append(file)12        sub_dir.append(subdir)13 14#print(file_name)15completed_files=open('./completed_files.txt').read().split('\n')16# completed_files=[]17 18# Benign Analysis ........................19# for z in range(0, len(file_name)):20# 	if 'raw' in file_name[z].split('.'):21# 		# print(file_name[z])22# 		if file_name[z] not in completed_files:23# 			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + '  imagecopy -O ./' + file_name[z].split('.')[0] + '.raw', shell=True)24# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 psscan --output=text --output-file=./scans/psscan/Benign\ Analysis/'+file_name[z].split('.')[0]+ '_psscan.txt',shell=True)25# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 pslist --output=text --output-file=./scans/pslist/Benign\ Analysis/'+file_name[z].split('.')[0] + '_pslist.txt', shell=True)26# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 malfind --output=text --output-file=./scans/malfind/Benign\ Analysis/'+file_name[z].split('.')[0] + '_malfind.txt', shell=True)27# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 pstree --output=text --output-file=./scans/pstree/Benign\ Analysis/'+file_name[z].split('.')[0] + '_pstree.txt', shell=True)28# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 psxview --output=text --output-file=./scans/psxview/Benign\ Analysis/'+file_name[z].split('.')[0] + '_psxview.txt', shell=True)29# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 yarascan -y ./malware_rules.yar --output=text --output-file=./scans/yarascan/Benign\ Analysis/'+file_name[z].split('.')[0]+ '_yarascan_complete.txt', shell=True)30# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 vadwalk  --output=text --output-file=./scans/vadwalk/Benign\ Analysis/'+file_name[z].split('.')[0] + '_vadwalk.txt', shell=True)31# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 vadinfo  --output=text --output-file=./scans/vadinfo/Benign\ Analysis/'+file_name[z].split('.')[0] + '_vadinfo.txt', shell=True)32			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + '--profile=Win10x64_18362 memmap --output=text --output-file=./scans/memmap/Benign\ Analysis/' + file_name[z].split('.')[0] + '_memmap.txt', shell=True)33 34		# else:35		# 	continue36#37	# else:38	# 	continue39 40 41# Ransomware Analysis.......................42for z in range(0, len(file_name)):43	if 'raw' in file_name[z].split('.'):44		# print(file_name[z])45		if file_name[z] not in completed_files:46			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + '  imagecopy -O ./' + file_name[z].split('.')[0] + '.raw', shell=True)47			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 psscan --output=text --output-file=./scans/psscan/Ransomware\ Analysis/'+file_name[z].split('.')[0]+ '_psscan.txt',shell=True)48			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 pslist --output=text --output-file=./scans/pslist/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_pslist.txt', shell=True)49			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 malfind --output=text --output-file=./scans/malfind/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_malfind.txt', shell=True)50			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 pstree --output=text --output-file=./scans/pstree/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_pstree.txt', shell=True)51			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 psxview --output=text --output-file=./scans/psxview/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_psxview.txt', shell=True)52			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 yarascan -y ./malware_rules.yar --output=text --output-file=./scans/yarascan/Ransomware\ Analysis/'+file_name[z].split('.')[0]+ '_yarascan_complete.txt', shell=True)53			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 vadwalk  --output=text --output-file=./scans/vadwalk/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_vadwalk.txt', shell=True)54			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 vadinfo  --output=text --output-file=./scans/vadinfo/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_vadinfo.txt', shell=True)55			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 memmap  --output=text --output-file=./scans/memmap/Ransomware\ Analysis/' + file_name[z].split('.')[0] + '_memmap.txt', shell=True)56 57		else:58			continue59#60	else:61		continue62