dorothy2
A Ruby framework for automated malware and botnet analysis using sandboxed virtual machines and network traffic dissection.
What is dorothy2?
Dorothy2 is an open-source malware and botnet analysis framework written in Ruby. It automates the execution of suspicious binaries in sandboxed virtual machines, captures network traffic and system behavior, and provides tools for dissecting and visualizing the results to aid security researchers.
Security researchers, incident response teams (CSIRTs), and malware analysts who need to automate the analysis of suspicious binaries in controlled environments.
It offers a highly modular and flexible environment for sandbox-based malware analysis with a strong focus on network traffic dissection, allowing teams to customize analysis profiles and integrate with existing infrastructure.
Overview
A malware/botnet analysis framework written in Ruby.
Use Cases
Best For
- Automating malware analysis in sandboxed Windows environments
- Dissecting network traffic from botnet command-and-control communications
- Security teams needing customizable analysis profiles for different OS targets
- Incident responders analyzing suspicious binaries from email or folder sources
- Research projects requiring centralized storage of malware analysis results
- Educational environments teaching malware analysis and network forensics
Not Ideal For
- Organizations without access to VMware ESX infrastructure or licenses
- Teams needing to analyze malware targeting non-Windows operating systems (e.g., macOS, Linux) without extensive customization
- Incident response scenarios requiring rapid deployment and minimal setup time
- Environments demanding a secure, production-ready web interface for external data sharing
Pros & Cons
Pros
The framework is split into independent modules (Binary Fetcher, Analysis Engine, Data Extractor), allowing teams to customize and extend functionality as needed, as highlighted in the README's overview.
It prioritizes network analysis by capturing PCAPs, extracting flows and GeoIP data, and downloading files via HTTP/HTTPS, providing deep insights into botnet communications.
Users can define analysis profiles with specific OS types, versions, and timeouts, enabling targeted testing against environments that match customer setups, as described in the introduction.
Results are stored in PostgreSQL (Dorothive) and CouchDB for network packet indexing, facilitating long-term analysis and data retrieval, as noted in the key features.
Cons
Installation involves configuring VMware ESX, virtual networks, multiple VMs, and dependencies like pcapr-local, which the README admits is 'not the easiest task' and can be error-prone.
It only supports VMware ESX >= 5.0, excluding free ESXi and other hypervisors, restricting use in environments with different virtualization tools.
Static binary analysis and improved system behavior analysis are noted as 'shortly introduced in the next versions,' indicating missing core features that competitors might offer.
The WebGUI is described as a 'dummy' Sinatra application not meant for public exposure, lacking advanced UI features and security for enterprise deployment.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.