theinfobots/malware-sandbox repository overview

⁠Malware Analysis Sandbox (CLI)

A robust, Ubuntu-based sandbox designed for safe malware analysis in a terminal environment.

⁠Features

This image comes pre-installed with powerful tools for security research:

• Static Analysis: yara, binwalk, radare2
• Dynamic Analysis: strace, ltrace, gdb
• Network Monitoring: tcpdump, net-tools, iptables
• Utility: python3, curl, wget, git, vim, unzip

⁠Security Philosophy

The sandbox is built on the "Everything In, Nothing Out" principle.

1. Network Isolation: Best run with --network none after samples have been downloaded.
2. Read-Only: Recommended to run with --read-only to prevent malware from modifying the system permanently.
3. Non-Root: All analysis is performed as the analyst user.

⁠Quick Start

docker run -it --rm \
    --network none \
    --read-only \
    --tmpfs /tmp \
    --tmpfs /run \
    -v malware_data:/home/analyst/downloads \
    theinfobots/malware-sandbox:latest

Warning: This environment is intended for handling real malware. Use on an isolated machine.