By providing deep control over the sample, it facilitates the extraction of features like API calls and network communication even when the malware attempts to remain dormant.
Peekaboo is an automated tool built on the Intel Pin DBI framework. Its primary purpose is to bypass the evasive maneuvers modern malware uses to detect virtual machines (VMs) or debuggers, allowing researchers to capture "authentic" behavior that would otherwise remain hidden.
The tool monitors malware at multiple levels, including instructions, APIs, and system calls.
Peekaboo is used to generate labeled datasets for AI and machine learning training in cybersecurity.
Peekaboo intercepts routines and monitors the number of modules loaded, system calls made, and threads created to determine the sample's runtime behavior.