Commands / kosa8 lab

kosa8 lab

Detonate malware on a simulated internet and produce signed reports

The Forensics and Malware Lab. A sample runs in a sandbox whose only network is fakenet: every DNS name resolves, every connection is answered — HTTP, TLS (from a lab CA), SMTP, anything — by a simulated internet on the host that records what the sample said and forwards nothing. The run is captured to pcapng, the infected machine is snapshotted and sealed, and the result is a signed report package anyone can verify offline.

kosa8 lab detonate SAMPLE --image alpine:3.20 run a sample, write a report kosa8 lab verify REPORT.tar --pubkey KEY check a report kosa8 lab diff A.tar B.tar compare two reports kosa8 lab net SANDBOX a fakenet sandbox's record kosa8 lab ca [--out FILE] the lab CA, to install in images

Only Linux samples run: the guest is Linux. See docs/design/malware-lab.md for what is simulated, what a sample can still detect, and why nothing can leave.

Subcommands