dorothy2
A Ruby framework for automated malware and botnet analysis using sandboxed virtual machines and network traffic dissection.
What is dorothy2?
Dorothy2 is an open-source malware and botnet analysis framework written in Ruby. It automates the execution of suspicious binaries in sandboxed virtual machines, captures network traffic and system behavior, and provides tools for dissecting and visualizing the results to aid security researchers.
Security researchers, incident response teams (CSIRTs), and malware analysts who need to automate the analysis of suspicious binaries in controlled environments.
It offers a highly modular and flexible environment for sandbox-based malware analysis with a strong focus on network traffic dissection, allowing teams to customize analysis profiles and integrate with existing infrastructure.
Overview
A malware/botnet analysis framework written in Ruby.
Use Cases
Best For
- Automating malware analysis in sandboxed Windows environments
- Dissecting network traffic from botnet command-and-control communications
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
