PayloadSecurity Analyzer

[typonino]

Hello,

I have created a Payload Security Sandbox Cortex analyzer.
It has been tested on private instance, but should be working on private cloud also.

It allows to submit file or URL from Cortex for sandbox analysis.

Also add report template for thehive integration.

Regards

[jeromeleonard]

Hi,

Thank you for the PR. File submission works like a charm on my side, but cannot run URL submission without getting a {"error":"bad-url"} from Hybrid Analysis API. The server response is HTTP/200 and content is {"response_code":-1,"response":{"error":"bad-url"}}. Could you please have a look ?

Thx.

[typonino]

Hi jeromeleonard ,

Can you share the URL you have tested. Have you done a test directly through PayloadSecurity to compare? I have noticed also issues with a few URL but it seems to be more on PayloadSecurity side.

Regards,

[jeromeleonard]

Hi, this one for example : hxxp://165[.]227[.]215[.]25/xmrig-aeon[.]exe . I did not test directly on PayloadSecurity as there is already a report for that URL. (hxxps://www[.]hybrid-analysis[.]com/sample/348c7dd59ea1b4e88585863dd788621f1101202d32df67eb0015761d25946420?environmentId=120)

[typonino]

Hi Jerome,

I have tested on premise payload security and it's works as expected. I think it's because on hybrid-analysis you can only submit file when you are using the free service.

[jeromeleonard]

Thank you @typonino, indeed it sounds related the the type of service level used.