There are no specific requirements for hardware equipment. Requirements for minimum RAM is 2 GB (for virtualization) and free space in the hard disk drive of about 40 GB. In this book, I will use the following hardware specifications as the Host OS:

Theoretically, Cuckoo Sandbox can run on every Linux operating system. In this book, all instructions in the Host OS will be conducted in Ubuntu 12.04.

Before continuing to the installation and configuration process, you need to install some applications and libraries.

We need to type in the following command:

$ sudo apt-get install python

Cuckoo needs the SqlAlchemy application as the database toolkit for Python. So you need to install SqlAlchemy with the following command line:

$ sudo apt-get install python-sqlalchemy

You can also use pip command to install SqlAlchemy. Pip is a tool for installing and managing Python packages.

$ sudo pip install sqlalchemy

There are other optional dependencies that are mostly used by modules and utilities. The following libraries are not strictly required, but you should have the libraries to guarantee Cuckoo Sandbox runs smoothly in your environment:

All the packages can be installed by using a one-line apt-get command:

$ sudo apt-get install python-dpkt python-jinja2 python-magic python-pymongo python-libvirt python-bottle python-pefile ssdeep

Or you can install all the packages using pip package management (except python-magic and python-libvirt):

$ sudo pip install dpkt jinja2 pymongo bottle pefile

You have to install pydeep for ssdeep fuzzy hashes of samples; but before installing Pydeep, we need to install some dependencies with the following command line:

Next, you have to clone pydeep from the the git source (put pydeep in the /opt folder):

$ cd /opt
$ git clone https://github.com/kbandla/pydeep.git pydeep
$ cd /opt/pydeep/
python setup.py build
sudo python setup.py install

You will also need to install yara to categorize malware samples (put yara in /opt folder):

$ sudo apt-get install automake -y
$ cd /opt
$ svn checkout http://yara-project.googlecode.com/svn/trunk/yara
$ cd /opt/yara
$ sudo ln -s /usr/bin/aclocal-1.11 /usr/bin/aclocal-1.12
$ ./configure
$ make
$ sudo make install
$ cd yara-python
$ python setup.py build
$ sudo python setup.py install

You need to install tcpdump in order to dump network traffic which occurs during analysis:

$ sudo apt-get install tcpdump

If you want to run the tcpdump, you need root privileges; but since you don't want Cuckoo to run as root, you'll have to set specific Linux capabilities to the binary, as shown in the following command line:

$ sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

You can verify the results of the last command with:

$ getcap /usr/sbin/tcpdump /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip

If you don't have setcap installed, you should install this library:

$ sudo apt-get install libcap2-bin

Otherwise (not recommended) run the following command line:

$ sudo chmod +s /usr/sbin/tcpdump

The chmod +s command means SUID bit. you add both user ID and group ID permission to a file. In this case, it is tcpdump. If you set the SUID bit "s" on tcpdump, then other users can run it and they will become the root for as long as the tcpdump process is executing. That is why this step is not recommended.

After you finish setting up the Host OS, you need to install and configure Cuckoo Sandbox in your Host OS.

In this section, you will set up Cuckoo Sandbox and configure it:

In this book, we will use VirtualBox 4.2.12 for the Linux Host (If you can't find Version 4.2.12, you can use newer versions. But if you want to download Version 4.2.12, please go to https://www.virtualbox.org/wiki/Download_Old_Builds_4_2). There are several versions of VirtualBox for your Linux OS. We will download Ubuntu 12.04 LTS ("Precise Pangolin") AMD64 version (this one is for the 64-bit version if you are using a 32-bit version, you can choose to download i386).

Before setting up your Guest OS in VirtualBox, you need to pay attention to Vbox driver. You need to set up vboxdrv first before creating your Guest OS. In order to set up the vboxdrv, you need to install kernel headers of your Linux. The kernel headers will be required in compiling vboxdrv. If you want to be sure about your kernel version, you can use this command:

$ uname –a

You will see an output like this:

Linux digit-labs 3.5.0.17-generic #28-ubuntu SMP Tue Oct 9 19:31:23 UTC 2012 x86_64x86_64 x86_64 x86_64 GNU/Linux

It means you are using kernel Version 3.5.0.17, and you need to install the kernel headers using this command:

$ apt-get install linux-headers-3.5.0.17-generic

After you're finished installing the Linux headers, you can set up vboxdrv with the following command lines:

$ sudo /etc/init.d/vboxdrv setup
* Stopping VirtualBox kernel modules         [OK]
* Recompiling VirtualBox kernel modules        [OK]
* Starting VirtualBox kernel modules        [OK]

If all the output is OK, it means you can now set up the Guest OS.

The required specifications to set up the Guest OS are listed as follows:

In the first step, we will create the guest OS. You can write down your guest OS name, and operating system type. Since we are using Windows XP as guest OS, you can choose Windows XP in the OS type and version.

Before you start your Guest OS in VirtualBox, you need to configure the network, sharing folder, and the installing of VirtualBox Guest Addition to improve its capabilities in the malware analysis process.

You can either run Cuckoo from your own user or create a new one dedicated just to your Sandbox setup. We recommend you to create a specific user for your Cuckoo Sandbox environment. Make sure that the user that runs Cuckoo is the same user that you will use to create and run the virtual machines, otherwise Cuckoo will not be able to identify and launch them. Just run the following command line in terminal:

$ sudo adduser cuckoo

If you're using VirtualBox, make sure the new user belongs to the vboxusers group (or the group you used to run VirtualBox):

$ sudo usermod -G vboxusers cuckoo

If you're using KVM or any other libvirt-based module, make sure the new user belongs to the libvirtd group (or the group your Linux distributor uses to run libvirt):

$ sudo usermod -G libvirtd cuckoo

Now it's time for the best part, let's install and configure Cuckoo Sandbox.

Extract or checkout your copy of Cuckoo to a path of your choice and you're ready to go. For example, we can put it in the /home/username/cuckoo path.

First things first, we need to configure Cuckoo's configuration files, which consist of the following main files:

The aforementioned .conf files are described in detail in the following sections.

# Add your VirusTotal API key here. The default API key, kindly# provided by the VirusTotal team, should enable you with a # sufficient throughput and while being shared with all our users, # it should not affect your use.

key = a0283a2c3d55728300d064874239b5346fb991317e8449fe43c902879d758088

$ vboxmanage snapshot "WIndows-cuckoo" take "WIndows-cuckooSnap01" --pause 

$ vboxmanagecontrolvm "WIndows-cuckoo " poweroff
$ vboxmanage snapshot "WIndows-cuckoo" restorecurrent
$ vboxheadless --startvm "WIndows-cuckoo"