HackDig : Dig high-quality web security articles for hackers

New Year's Resolution: Build Your Own Malware Lab?, (Thu, Jan 5th)

2017-01-06 00:45

If youre looking to build your own malware lab using open-source tools to take your GREM skills to the next level, take a look at Robert Simmons of ThreatConnects talk at VirusBulletin from a few months ago. Has a brief paper, but the video is people what you want to look at if you are new to all this. In essence, it is set up of the following components: Cuckoo Sandbox (with some modications), volatility (for memory analysis), thug (for a low interaction honeyclient), and Bro (for network analysis). It probably would only take a half-day of your time to set up and you can be off to the races on analyzing malware thats fresh off the wire.

Couple of notes, always be sure to do this from a non-attributed network (i.e. not your company). Sandboxing involves running actual malware so it will set off the IDS. Many of my sandbox systems run behind a pfsense firewall that connects to a commodity VPN so I cant easily be directly tied to things and has the advantages of letting me change what country I am in as malware may behave differently when it thinks it is running in different countries.

Take a look and let us know if you find more interesting things out there with your malware hunting efforts.

--
John Bambenek
bambenek at gmail /dot/ com
Fidelis Cybersecurity

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.


Source: ssr;pma&58812=diyrots?lmth.yraid/ude.snas.csi

Read:3486 | Comments:0 | Tags:No Tag

“New Year's Resolution: Build Your Own Malware Lab?, (Thu, Jan 5th)”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Tools

Tag Cloud