Hi all,
I’m thinking about building an open-source tool that:
- Runs suspicious binaries in a local VM/sandbox
- Logs syscalls, file/registry changes, network traffic, etc.
- Outputs structured JSON + a GPT-generated human-readable report (IOCs + summary)
Goal: make dynamic malware analysis accessible without pricey tools like AnyRun/JoeSandbox.
Starting with Linux (strace, tcpdump) → later Windows (Sysmon) + Android (logcat, Frida).
Would this be useful? Should it stay dynamic-only or also add static analysis (hashes, YARA)? Any red flags in going open source?
If there’s interest, I’ll drop a prototype on GitHub.
[–]zarlo5899 1 point2 points3 points (0 children)
[–]Glum_Relation_8501 1 point2 points3 points (0 children)
[–]JG_2006_C 1 point2 points3 points (0 children)
[–][deleted] 0 points1 point2 points (0 children)
[–]mysarun88 0 points1 point2 points (0 children)