Skip to content
AntinomieAntinomie0.8.0 docs

Recordings contain secrets

Antinomie records what a program passes to the kernel, byte for byte. That is the point of the tool, and it means a recording holds whatever the program handled.

What a recording can contain

Section titled “What a recording can contain”
  • Buffers of calls. What a program reads, writes, sends and receives, so file contents, network payloads, commands and any keys or tokens it handled.
  • Keys and credentials. Payloads of keyctl, socket filters, environment variables, command lines and registers are recorded like any other buffer.
  • Written file content New in 0.8.0. The bytes the run wrote to each file, up to the caps in Settings → Advanced, and the earlier bytes of the files it changed, copied from the guest’s disk into the recording (file-before/). Saved File Reconstructions go to reconstructed/ in the recording.
  • The sample itself. Static analysis keeps a complete, unencrypted copy of the executable in the run’s analysis/ folder, and unpacked layers beside it.
  • Terminal transcripts, including whatever you typed into the run’s terminal.
  • Packet captures of cleartext traffic, and the TLS server names of encrypted traffic.
  • Memory dumps and cores. A RAM dump holds everything resident in the guest at that moment, including data from programs other than the sample.
  • Disk dumps. A disk dump from the Disks tab is the whole guest filesystem: every file on it, including the guest account’s files and anything the sample wrote or downloaded. Files extracted from a guest disk are copies of the same.
  • File hashes and user names. On a revision-17 or newer base, the recording holds the SHA-256 of files the program ran, wrote or deleted, and Triage names guest users from the base’s /etc/passwd.
  • The run’s launch settings, including Environment values.
  • Cloud VPS runs New in 0.8.0 record the metadata requests and the canary credentials handed out (cloud-metadata.json). The canaries are random values, not real credentials.

The guest account password you give when creating a Debian VM is not stored in plain text in recordings or settings; the guest stores only its hash. Anything you type into a terminal or into the guest is a different matter.

Samples, custody and reports

Section titled “Samples, custody and reports”
New in 0.8.0
  • The sample library (samples/ in the data folder) keeps every sample you add, download or upload into a VM as an owner-only AES zip with the password infected, decrypted only in memory. Its database holds names, tags, origins, including the host path an upload came from, and the custody log. A file uploaded by mistake stays there until you remove it.
  • The custody log records terminal input to a run by size only, but the recording itself still keeps the content.
  • Reports are owner-only files in <recording>/report/ unless you choose a folder. JSON, MISP and STIX keep indicators raw; defanging applies only to HTML and PDF, and only when you tick it.
  • The evidence bundle’s outer .zip is not encrypted: its packet captures and the sample’s custody record can be read by anyone who has the file. The files the run dropped are in an inner AES-256 archive with the password infected, which stops accidental opening and scanning, not reading.

Handle recordings like the sample

Section titled “Handle recordings like the sample”
  • Store the data folder on an encrypted volume, and back it up with the same care.
  • Do not share a recording, a dump, a disk image, a pcap, a report or an evidence bundle without reviewing it. Exports carry the same secrets. See Export and other tools.
  • A recording or a bundle can contain the malware’s payloads and can trigger antivirus on the host or on the computer you copy it to.
  • Delete what you no longer need. Retention is yours to manage; see Retention and backups.