What this code does:

1. Retrieve malware sample metadata file
2. Verify necessary fields within metadata file (scan info and file extension)
3. Validate corresponding malware sample file exists
4. Revert each virtual machine to known good snapshot
5. Start each virtual machine from snapshot
6. Transfer malware sample to each virtual machine
7. Verify the malware sample made to the system
8. Run malware sample on each virtual machine
9. Collect exit code from each run sample on each virtual machine (if possible)
10. Collect process logs filtering for the sample name from each virtual machine (if possible)
11. Collect application whitelisting logs from each virtual machine filtering for the sample name (if possible)
12. Log collected data to mongo
13. Stop the virtual machine
14. Repeat steps until all valid samples in selection have been tested

File Descriptions

vm-runner/runner.py - main app for running orchestrating the VMs and experiment
vm-runner/load_runner.json - main config file
vm-runner/vm_control.py - lib for controlling VirtualBox
vm-runner/vt_builder.py - lib for reading AV info
vm-runner/data_logger.py - data logger library for pushing things into mongo
vm-runner/data_parse.py - parser script for the mongo dump to determine whitelisting effectiveness
vm-runner/imavirus.c - test code - compile to test whitelisting apps
vm-runner/imavirus_fail.c - test code - compile to test whitelisting apps
vm-runner/README.MD - this

Necessary sub dirs:

vm-runner/loggerdump
vm-runner/tmp

Installation:

1. Install base OS, Ubuntu
2. Install virtualbox
3. Clone this repo
4. Get a copy of the VirusTotal academic database
5. Create loggerdump and tmp directories
6. Modify the vt_builder.py to reflect file locations
7. Modify the load_runner.json file to reflect necessary parameters (creds, sample numbers, etc.)
8. Test runner.py with a low number of samples configured in load_runner.json
9. Modify scripts to fit your environment
10. Run the data_parse.py on the dumped 'data' log
11. Evaluate your results!