Bob And The Robber

Understanding Bob and the Robber for Malware Analysis

Bob and the Robber is a modular malware sandbox framework designed to automate behavioral analysis of suspicious binaries. Unlike commercial solutions that charge per VM hour, this tool runs on infrastructure you already have. It was created by researchers at Kaspersky to handle the repetitive task of detonating samples and collecting telemetry without manual intervention every time. The core idea is straightforward. You drop a binary into the input folder, the system spins up isolated environments, executes the sample across multiple angles, and dumps whatever artifacts it can find. Behavior logs, network captures, file system changes, registry modifications — all of that gets collected and formatted into reports. The framework is written in Python and is openly available on GitHub under an open-source license.

Installing and Configuring Bob And The Robber

Start by cloning the repository and running the dependency installer. The project relies heavily on Python packages, virtualenv, and a few system-level libraries depending on your host OS. Ubuntu 20.04 or later tends to cause the fewest issues. Windows hosts work too, but the documentation assumes a Linux environment for the control side while samples run inside virtual machines or containers. Configuration happens through YAML files. You define sample paths, report destinations, and which analysis modules to activate. The default config includes basic behavioral monitoring through process tracing and file system watching. Network capture is handled by default using a built-in TCPdump wrapper, and you can extend it with custom analyzers if needed. I spent a few hours fighting with the socket permissions on a RHEL-based host before realizing the issue was just AppArmor blocking packet socket creation. Adding the proper profile entry and restarting the service fixed it immediately. Virtual machine management is pluggable. The framework ships with support for VirtualBox and VMware by default. You point it at existing VM snapshots, and it boots, runs the sample, and snapshots back to baseline automatically. Make sure each base VM has the necessary agents installed — process monitor, file watcher, and network traffic collector — before you register them with the tool. Skipping this step means you get empty reports and no error message telling you why.

Running an Analysis Job

Once the config is set, adding a sample is as simple as placing it in the designated input directory. The scheduler picks it up and routes it through the configured analysis chain. Each module runs independently, so a network capture module won't block a file system monitor. Results are written to the output directory in JSON and HTML formats. One thing most guides don't mention: the concurrency settings matter a lot. By default the tool spawns one analysis per available CPU core, but network capture can saturate disk I/O pretty quickly. On a system with 16 cores and an SSD, cranking concurrency to 8 gave solid throughput. Drop that to 24 and you'll see report generation times spike because the file write queue backs up. I learned this after my first production run, where I set concurrency to 32 and watched the disk usage graph turn into a solid block for twenty minutes before any reports came out. Sample scheduling supports tags and priority levels. You can mark certain file types as high priority so they jump the queue. This is useful when you are processing a batch of PE files alongside a handful of Office macros that need faster turnaround. The tagging system is basic but functional.

Custom Modules and Extensibility

The real value of Bob and the Robber shows up when you write custom analysis modules. Each module implements a standard interface with a single execute method that takes the sample path and returns structured data. Python is the language, and the scaffolding makes it painless. I wrote a module that feeds samples into a string reconstruction engine to extract embedded C2 configurations from packers that use custom encoding. The built-in modules won't touch obfuscated strings. A custom analyzer fills that gap. Module testing runs through the built-in test runner. Pass a known sample and compare the output against an expected results file. This catches regressions before they hit your main analysis pipeline.

Limitations and When Not to Use It

Bob and the Robber is not a silver bullet. It struggles with samples that detect virtualization through CPUID checks, hardware enumeration, or timing-based heuristics. If your VM snapshots have inconsistent clock speeds or virtual hardware identifiers that differ from bare metal, some malware will simply refuse to execute. The workaround is running selective samples on dedicated bare metal machines and feeding those results back into the framework manually. It breaks automation but is necessary for high-sophistication targets. Memory-only malware is another blind spot. The framework captures behavioral artifacts at the OS level, but it does not dump and analyze full memory images during execution. Malware that loads entirely into RAM and never touches disk will produce little to no output. For those cases you need a companion memory forensics pipeline, which this tool does not provide. Storage requirements grow fast. A moderate analysis workload of a few hundred samples per day can consume hundreds of gigabytes within a week when you account for network captures and process traces. Plan your storage budget before committing to heavy daily use.

Where to Get It

The source code and full documentation are available on GitHub under the Kaspersky organization. Search for Bob and the Robber Malware Sandbox to find the official repository. The README covers installation, configuration, and module development in detail. Community support runs through GitHub issues and the Kaspersky research forum.