malware-detonation-platform Svelte Themes

Malware Detonation Platform

Naga is a next-gen malware sandbox with live screen recording, full TLS decryption, and real-time WebSocket streaming. Built with Go + Svelte, it spins up isolated VMs per detonation while enriching data with Suricata, YARA, CAPA, and MITRE ATT&CK tags. Modern UI, one-command Docker deploy.

Download

🐍 NAGA MALWARE DETONATION PLATFORM

🚀 Overview

Naga is a next-generation malware analysis sandbox that combines deep network forensics, real-time visualization, and a modern analyst-centric design.

⚡ "Stop treating malware analysis like a batch job. Start treating it like a live investigation."

Unlike traditional sandboxes (Cuckoo, CAPE), Naga delivers live streaming of the entire detonation process.

🧠 Core Philosophy

Traditional sandboxes generate reports after execution.
Naga flips this model by enabling analysts to:

  1. React instantly to suspicious behavior
  2. Intercept network traffic in real-time
  3. Visualize process relationships dynamically
  4. Understand WHY, not just WHAT

✨ Key Features

1. 🖥️ Isolated QEMU/KVM Virtualization

  • Fresh VM for every detonation
  • Full hardware emulation
  • Docker-based deployment (one command setup)
  • Auto lifecycle management (create → detonate → destroy → reset)

2. 🔓 Full TLS Decryption

  • Inspect real HTTPS payloads (not just 443/tcp)
  • Integrated mitmproxy
  • Auto certificate injection
  • Full certificate inspection

3. 📹 Live Screen Recording

  • Real-time execution via VNC stream
  • Video archive for later analysis
  • Low-latency WebSocket streaming

4. 🔍 Automated Enrichment Pipeline

Tool Purpose
Suricata Network intrusion detection
YARA Malware signature detection
CAPA Capability analysis
MITRE ATT&CK Behavior mapping

5. 🔀 Interactive Process Tree

  • Built using Sysmon telemetry
  • Parent-child relationships
  • MITRE ATT&CK tagging
  • Hover details (PID, command, techniques)

6. 🌊 Network Waterfall Visualization

  • Timeline of network activity

  • Color-coded traffic:

    • 🟢 Decrypted HTTPS
    • ⚪ Other traffic

  • DNS + certificate insights

7. ⚡ Real-Time WebSocket Streaming

  • Live updates:

    • VM status
    • Alerts
    • Processes
    • Network connections

  • ❌ No polling — only push-based events

8. 🎨 Modern UI (Svelte)

  • Clean & fast interface
  • Analyst-focused dashboard
  • Dark mode optimized
  • Responsive design

🏗️ Technical Architecture

📌 High-Level Stack

Frontend (Svelte)
   │
   │ REST / WebSocket
   ▼
Backend (Go)
   ├── VM Orchestration
   ├── Network Capture
   ├── Screen Capture
   └── Enrichment Engine
   │
   ▼
QEMU/KVM Virtual Machines

🧩 Components

Component Technology Purpose
VM Hypervisor QEMU/KVM + libvirt Isolation
Backend Go (Gorilla, NATS) API & orchestration
Frontend Svelte, D3, vis-network UI
Network Capture tcpdump, mitmproxy Packet + TLS
Screen Recording ffmpeg, VNC Live stream
Detection Suricata, YARA, CAPA Analysis
Telemetry Sysmon System events
Database PostgreSQL Storage
Backend NATS Communication
Message Bus Docker Compose Deployment

👨‍💻 Analyst Experience

🔎 What You See

  • Upload file / URL
  • Live execution dashboard
  • Process tree (interactive)
  • Network waterfall
  • Alerts panel

📡 Real-Time Event Example

[14:32:01] status: VM ready
[14:32:05] process: powershell.exe (PID 2345)
[14:32:06] mitre: T1059 - Command Execution
[14:32:07] network: 185.x.x.x:443 (HTTPS decrypted)
[14:32:08] alert: Suspicious PowerShell activity
[14:32:10] status: Completed

⚙️ Deployment

🖥️ Hardware Requirements

Resource Minimum
CPU 8+ cores
RAM 32GB+
Storage 200GB SSD
Network Isolated

🧰 Software Requirements

  • Ubuntu 20.04+ / Debian 11+
  • Docker + Docker Compose
  • QEMU/KVM + libvirt
  • Windows VM image

⚡ One-Command Setup

git clone https://github.com/yourusername/naga
cd naga
sudo ./scripts/setup-host.sh
docker-compose up -d

🎯 Use Cases

  1. 🛡️ SOC / Incident Response
  • Analyze phishing payloads
  • Investigate attacker infra
  • Generate reports
  1. 🧪 Threat Research
  • Study malware families
  • Build detection rules
  • Extract TTPs
  1. 🔴 Red Team
  • Test payloads safely
  • Validate detection footprint
  • Improve OPSEC
  1. 🎓 Education
  • Teach malware behavior
  • Demonstrate attacks live
  • Train analysts

⚖️ Comparison

Feature Naga Cuckoo CAPE Commercial
Live UI ✅ ❌ ❌ ⚠️ Partial
TLS Decryption ✅ ❌ ❌ ✅
Process Tree ✅ ⚠️ Static ⚠️ Static ✅
Screen Recording ✅ ❌ ❌ ✅
Deployment Easy Hard Hard N/A
Cost FREE FREE FREE $$$

🔐 Security & Isolation

⚠️ CRITICAL WARNING

  • ❌ Never run on production networks
  • 🔒 Use isolated environment / VLAN
  • 🧹 Reset VM after each detonation
  • 🚫 No sensitive data exposure
  • ✅ Only analyze authorized samples

🗺️ Roadmap

Feature Status
API Hooking 🟡 Planned
Memory Analysis 🟡 Planned
Multi-VM 🟡 Planned
YARA Editor 🟡 Planned
STIX Export 🟡 Planned
Cloud Support 🔵 Under Review

📦 Project Status

  • Version: v0.1.0 (Alpha)
  • License: MIT
  • Maintainer: SunChero
  • Started: April 1, 2026

🐍 Why "Naga"?

Named after the mythical serpent that guards treasures.

💡 Naga helps analysts uncover hidden malware behavior while resetting clean after each detonation.

📌 Summary

Naga redefines malware sandboxing:

  • ⚡ Live, not batch
  • 🎨 Visual, not static
  • 🧠 Analyst-first design
  • 🚀 Easy deployment

⭐ Support

If you like this project:

  • 👉 Star the repo
  • 👉 Share with researchers
  • 👉 Contribute to development

Top categories

tailwinddaisyuiadmin templatepopupmdsvexportfolioblogformecommerceuicarouselauthdarkseoimagerouting
Loading Svelte Themes