Safe use

Antinomie runs real malware when you ask it to

The sample executes inside a QEMU guest. A VM is a strong boundary, not an absolute one: guest-to-host escapes are rare but possible, and a sample you give network access can reach whatever that network reaches. Run unknown files only on a computer you can rebuild.

Before you run a sample

• Use a dedicated computer, or at least a user account with nothing valuable and no credentials or personal data on it.
• Keep VM networking disconnected unless the analysis needs a network.
• When a sample needs a network, prefer a run route that keeps traffic local: None (drop) or InetSim.
• Avoid NAT for untrusted samples: it lets the guest reach the host’s own network services and your local network, as well as the Internet.
• Treat recordings, captures and exported evidence as sensitive: they can contain the sample itself and anything typed into the guest, including passwords.
• Run only samples you are permitted to handle. You are responsible for the traffic a sample sends through any route you enable.

What the guest kernel can and cannot tell you

Antinomie observes from a patched kernel inside the guest. A sample that gains root in the guest, or exploits the guest kernel, can interfere with what that guest records. Loss and partial-recording indicators stay visible, but a missing event is not proof that something did not happen. Stealth profiles reduce obvious VM artefacts; they do not make the VM undetectable.

Detections are leads to investigate, not a verdict that a file is or is not malicious.

Learn more and report problems

• Security model: trust boundaries, network modes, sensitive data and what leaves the computer.
• Security policy: report a vulnerability privately through GitHub. Do not open a public issue for it, and never attach live malware or real credentials to an issue.