From 955243755d92ecedf772070699941a4d0824949f Mon Sep 17 00:00:00 2001 From: unknown Date: Wed, 14 Jun 2017 09:51:33 +0000 Subject: [PATCH] Add imagehash and upx to requirements. --- README.md | 2 +- requirements.txt | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 5d9874bd2..c20f7c059 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ CAPE can detect a number of malware techniques or behaviours, as well as specifi This detection then triggers a second run with a specific package, in order to extract the malware payload and possibly its configuration, for further analysis. -CAPE works by controlling malware via a bespoke debugger and API hooks. Detection to trigger a CAPE package can be based from on 'Cuckoo' (API) or Yara signatures. The debugger uses Yara signatures or API hooks to allow breakpoints to be set on individual instructions, memory regions or function calls. Once a region of interest is reached, it can be manipulated and dumped for processing and analysis, and possibly configuration parsing. +CAPE works by controlling malware via a bespoke debugger and API hooks. Detection to trigger a CAPE package can be based on 'Cuckoo' (API) or Yara signatures. The debugger uses Yara signatures or API hooks to allow breakpoints to be set on individual instructions, memory regions or function calls. Once a region of interest is reached, it can be manipulated and dumped for processing and analysis, and possibly configuration parsing. The techniques or behaviours that CAPE detects and has packages for include: - Process injection diff --git a/requirements.txt b/requirements.txt index e105f3c67..b0e78c0f2 100644 --- a/requirements.txt +++ b/requirements.txt @@ -29,3 +29,5 @@ git+https://github.com/crackinglandia/pype32.git git+https://github.com/jsocol/django-ratelimit git+https://github.com/kbandla/pydeep.git pyvmomi>=6.0 +imagehash +upx