Safe Mode Demo Labs - Tamoaki Tani - malconfscan with cuckoo
A demonstration of using MalConfScan with Cuckoo Sandbox to extract configuration data from malware families in memory.
Summary
Researchers Tomoaki Tani and Shusei Tomonaga from JPCERT/CC demonstrate "MalConfScan with Cuckoo," an automated memory forensic plugin for Cuckoo Sandbox that automatically extracts configuration data and command-and-control (C2) infrastructure from infected Windows and Linux hosts [00:04, 03:42].
The presenters demonstrate live extraction workflows on real-world malware families, such as the TSCookie backdoor used by BlackTech and Ursnif banking malware [07:49, 11:55]. They explain how the tool leverages Volatility memory analysis to bypass sophisticated anti-analysis techniques—such as VM detection checks searching for "VBox" or "VMware" device names [15:05]—allowing incident responders to extract decrypted C2 IP addresses, domains, and operational configurations in seconds [19:15].
(AI summary — Gemini Flash)
Related talks
Blue Team Village·36 min
Project Obsidian
Project Obsidian walks through triaging and reverse engineering high volumes of malicious email attachments and phishing lures.
Main Stage·44 min
Andrew Case · Chad Sellers · Golden G. Richard III
Memory forensics techniques and Volatility 3 plugins designed to detect direct syscalls, module stomping, and EDR bypasses.
CSIT Village·18 min
Theodore Lee
Theodore Lee examines reverse engineering (RE) is time consuming and resource intensive.