By using MalwareCMDMonitor python script, you can observe the commands of the latest malware instances executed on hybrid-analysis.com sandbox. In a nutshell, it downloads the HA feed and then retrieves commands of unseen instances; the ones that did not appear in the previous feeds.
Also ReadJava-Stager : A PoC To Download, Compile & Execute A Java File In Memory
To run the script
python hybrid_analysis.py
However, if you want to run the script on a regular basis, you can use –daemon (or -d for short) switch.
python hybrid_analysis.py --daemon
Running the above command results in getting the feed every hour. To change the interval, you can use –cycle (or -c) and specify the number of minutes the script must wait before retrieving the feed again.
python hybrid_analysis.py --daemon --cycle 120
In the above example, the script sleeps for 2 hours between each feed retrieval. Moreover, you can use –output (or -o) to specify the output file that you want to store the results. By default, the output is written on the console.
python hybrid_analysis.py --daemon --cycle 120 --output "c:\test\ha - cmd.log"
Last but not least, you can see all the switches by using –help (or -h)
python hybrid_analysis.py -h
The groupdel command in Linux removes a group from the system. It deletes the group's entry from /etc/group and /etc/gshadow,…
The wc command in Linux counts lines, words, characters, and bytes in files or standard input. It…
The top command in Linux provides a real-time view of running processes and system resource usage. From…
The usermod command in Linux modifies existing user account attributes. You can use it to manage group…
The sort command in Linux reads lines from files or standard input and writes them to standard…
The wall command in Linux sends a message to the terminals of all currently logged-in users. The…