Cheshire


Cheshire

**Pre-flight payload QA for Adaptix, powered by LitterBox.**

Cheshire is an Adaptix C2 service plugin that bridges the Adaptix client to a [LitterBox](https://github.com/BlackSnufkin/LitterBox) sandbox. From inside the Adaptix UI, an operator can pick any binary, dispatch it through LitterBox's full analyzer chain (static + dynamic + every reachable EDR profile), and watch the verdict materialize without ever leaving Adaptix.

The name follows the project mascot lineage:

• Adaptix → chameleon
• LitterBox → grumpy cat
• The bridge between them → Cheshire (the cat that grins, fades in and out of view, and tells you whether the path ahead is safe).

---

What it does

Action	LitterBox endpoint(s)	Result
Upload payload	POST /upload	md5 + file metadata
Run All	POST /analyze/static/ + /analyze/dynamic/ + /analyze/edr// (×N profiles) in parallel goroutines	Static, Dynamic, every EDR profile populated as each completes
Static only	/analyze/static/	YARA / CheckPlz / Stringnalyzer findings
Dynamic only	/analyze/dynamic/	YARA-mem / PE-Sieve / Moneta / Patriot / HSB / RedEdr findings
EDR (multi)	/analyze/edr// per profile + Phase 2 polling on /api/results/edr//	Per-profile alerts table + comprehensive alert detail (reason, MITRE, API, memory region, call stack, final user module, process, parent, EDR responses)
Cleanup	DELETE /file/	Removes upload + result folders + per-sample analysis dirs from LitterBox
Fleet probe	GET /health	Sand