Awesome MCP › Security & Reverse Engineering

BlackSnufkin/LitterBox

⭐ 1536 YARA repository created 2024-12-25

LitterBox is a secure sandbox environment tailored for malware developers and red teamers, integrating with Large Language Model (LLM) agents via the Model Context Protocol (MCP) to provide advanced malware analysis and testing capabilities before deployment. It is designed to offer a controlled environment where security professionals can develop, test, and analyze payloads safely without exposing them to external vendors or triggering production security controls. The platform supports both red and blue teams by enabling testing of evasion techniques, validating detection signatures, and analyzing malware behavior in isolation. The system provides comprehensive analysis capabilities, including initial processing features like file identification using multiple hashing algorithms, entropy analysis for encryption and obfuscation detection, MIME and file type classification, and metadata preservation. It supports detailed executable analysis for Windows PE files, including architecture identification, compilation timestamp verification, subsystem classification, entry point analysis, section enumeration, and import/export table mapping. Document analysis for Microsoft Office files includes macro detection, VBA code security analysis, hidden content identification, and obfuscation detection. LitterBox incorporates multiple analysis engines: static analysis with signature detection, binary entropy profiling, string extraction, and pattern matching; dynamic analysis with runtime behavioral monitoring, memory inspection, process hollowing detection, code injection identification, sleep pattern analysis, and Windows telemetry collection; and Doppelganger analysis modules for system-wide process comparison and code similarity analysis using fuzzy hashing. The platform integrates various tools such as YARA for signature detection, CheckPlz for AV detection testing, Stringnalyzer for string analysis, PE-Sieve for in-memory malware detection, Moneta for memory region IOC analysis, Patriot for stealth technique detection, RedEdr for ETW telemetry, Hunt-Sleeping-Beacons for C2 beacon analysis, and Hollows-Hunter for process hollowing detection. LitterBox offers multiple access methods including a web UI, API access with extensive endpoints for file operations, analysis, and system management, and LLM integration through the MCP server. It requires Windows OS, Python 3.11+, and administrator privileges for deployment. Configuration is managed via a YAML file, allowing customization of server settings, allowed file types, and analysis parameters. Overall, LitterBox is a robust, MCP-supported sandbox platform that enhances malware analysis workflows by combining traditional and AI-assisted techniques, making it a valuable tool for cybersecurity professionals focused on malware development, testing, and defense.

https://github.com/BlackSnufkin/LitterBox

aiapiapi-accessbinary-entropyblender-modulecheckplzcode-injectionconfigurationcybersecuritydetection-mechanismsdetection-signaturesdoppelganger-analysisdynamic-analysisentropy-analysisevasion-techniquesfuzzyhash-modulehollows-hunterhunt-sleeping-beaconsisolated-environmentllm-agentsmacro-detectionmalware-analysismalware-behaviormalware-behavior-analysismalware-developersmalware-developmentmcpmcp-servermemory-inspectionmicrosoft-office-filesmonetapatriotpayload-testingpe-sieveprocess-hollowingprocess-hollowing-detectionpythonpython-3.11red-teamred-teamersrededrredteamruntime-monitoringsandboxsandbox-environmentsecurity-professionalssignature-detectionstatic-analysisstringnalyzertelemetry-collectionweb-uiwindowswindows-oswindows-pe-filesyara