Automating_Volatility.py

#!/usr/bin/env python3
import subprocess
import os

rootdir = './'
file_name=[]
sub_dir=[]

for subdir, dirs, files in os.walk(rootdir):
    for file in files:
        file_name.append(file)
        sub_dir.append(subdir)

#print(file_name)
completed_files=open('completed_files.txt').read().split('\n')
# completed_files=[]

# Benign Analysis ........................
for z in range(0, len(file_name)):
	if 'raw' in file_name[z].split('.'):
		# print(file_name[z])
		if file_name[z] not in completed_files:
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + '  imagecopy -O ./' + file_name[z].split('.')[0] + '.raw', shell=True)
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 psscan --output=text --output-file=./scans/psscan/Benign\ Analysis/'+file_name[z].split('.')[0]+ '_psscan.txt',shell=True)
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 pslist --output=text --output-file=./scans/pslist/Benign\ Analysis/'+file_name[z].split('.')[0] + '_pslist.txt', shell=True)
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 malfind --output=text --output-file=./scans/malfind/Benign\ Analysis/'+file_name[z].split('.')[0] + '_malfind.txt', shell=True)
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 pstree --output=text --output-file=./scans/pstree/Benign\ Analysis/'+file_name[z].split('.')[0] + '_pstree.txt', shell=True)
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 psxview --output=text --output-file=./scans/psxview/Benign\ Analysis/'+file_name[z].split('.')[0] + '_psxview.txt', shell=True)
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 yarascan -y ./malware_rules.yar --output=text --output-file=./scans/yarascan/Benign\ Analysis/'+file_name[z].split('.')[0]+ '_yarascan_complete.txt', shell=True)
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 vadwalk  --output=text --output-file=./scans/vadwalk/Benign\ Analysis/'+file_name[z].split('.')[0] + '_vadwalk.txt', shell=True)
			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 vadinfo  --output=text --output-file=./scans/vadinfo/Benign\ Analysis/'+file_name[z].split('.')[0] + '_vadinfo.txt', shell=True)
			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 memmap  --output=text --output-file=./scans/memmap/Benign\ Analysis/' + file_name[z].split('.')[0] + '_memmap.txt', shell=True)
		#
		else:
			continue

	else:
		continue


# Ransomware Analysis.......................
# for z in range(0, len(file_name)):
# 	if 'raw' in file_name[z].split('.'):
# 		# print(file_name[z])
# 		if file_name[z] not in completed_files:
# 			# subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + '  imagecopy -O ./' + file_name[z].split('.')[0] + '.raw', shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 psscan --output=text --output-file=./scans/psscan/Ransomware\ Analysis/'+file_name[z].split('.')[0]+ '_psscan.txt',shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 pslist --output=text --output-file=./scans/pslist/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_pslist.txt', shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 malfind --output=text --output-file=./scans/malfind/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_malfind.txt', shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 pstree --output=text --output-file=./scans/pstree/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_pstree.txt', shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 psxview --output=text --output-file=./scans/psxview/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_psxview.txt', shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 yarascan -y ./malware_rules.yar --output=text --output-file=./scans/yarascan/Ransomware\ Analysis/'+file_name[z].split('.')[0]+ '_yarascan_complete.txt', shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 vadwalk  --output=text --output-file=./scans/vadwalk/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_vadwalk.txt', shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 vadinfo  --output=text --output-file=./scans/vadinfo/Ransomware\ Analysis/'+file_name[z].split('.')[0] + '_vadinfo.txt', shell=True)
# 			subprocess.run('vol.py -f ' + sub_dir[z] + '/' + file_name[z] + ' --profile=Win10x64_18362 memmap  --output=text --output-file=./scans/memmap/Ransomware\ Analysis/' + file_name[z].split('.')[0] + '_memmap.txt', shell=True)
#
# 		else:
# 			continue
# #
# 	else:
# 		continue