The tool monitors malware at multiple levels, including instructions, APIs, and system calls.
Peekaboo is an automated tool built on the Intel Pin DBI framework. Its primary purpose is to bypass the evasive maneuvers modern malware uses to detect virtual machines (VMs) or debuggers, allowing researchers to capture "authentic" behavior that would otherwise remain hidden.
Peekaboo is used to generate labeled datasets for AI and machine learning training in cybersecurity. download-peekaboo-v1-3-7-0-online
It primarily runs on Windows 10 64-bit Pro guest VMs, managed by an Ubuntu 22.04 host management layer using Python.
It helps in identifying the true intent of packed or obfuscated malware by decompressing and analyzing them during execution. The tool monitors malware at multiple levels, including
By providing deep control over the sample, it facilitates the extraction of features like API calls and network communication even when the malware attempts to remain dormant.
This write-up covers the Dynamic Binary Instrumentation (DBI) tool, specifically focusing on its function in extracting authentic malware behavior. Peekaboo (version 1.3.7.0 online and similar builds) is designed to instrument and analyze evasive malware samples to defeat anti-analysis techniques. Overview of Peekaboo DBI Peekaboo is used to generate labeled datasets for
The architecture is decentralized to handle large-scale analysis (e.g., datasets of over 20,000 samples) by distributing malware across multiple virtual machines.