One cannot learn malware analysis thoroughly without doing some Hands-On practice in order to analyze
a malware.
We have to build a dedicated and isolated machine.
This is done to ensure that the malware doesn't harm any production systems.
This dedicated and isolated machine is called as sandbox.
There are different ways you can set up a sandbox.
Option one.
We have flare vm by FireEye, which is ready to use Windows based operating system, preloaded
with several tools used for malware analysis.
Option two, we can build everything from scratch using a hypervisor and several open source tools.
We will use this option for this course.
Before we start building our own sandbox from scratch, there are some caution we need to exercise,
like keep a separate virtual machine for malware analysis, that is, do not use this machine for any
other purpose.
Do not keep any important data on the machine.
Ensure the hypervisor is up to date.
Some malware can make use of vulnerabilities present in hypervisor to compromise.
Host computer.
Remove any network connectivity to the virtual machine as a best practice, always put the VM in host
only mode, also disable all network adapters.
Ensure there are no shared folders between VM and host machine.
Do not use USB devices with virtual machines.
When downloading any malware for analysis, always download password-protected samples.
An important note at this point in time, we have still not learned what is malware analysis or how to
do malware analysis.
However, let's get introduced to the list of tools that we will be using for malware analysis in our lab.
So if you get a question as to why we are downloading this list of tools.
Hold that thought for now and we will find the answer in the next Module.
Here's the list of software you would need to build the malware analysis lab.
Hypervisor, it could be virtual box or VMware workstation.
We will be using virtual box in this demo.
Windows 7 or Windows 10 operating system.
We will use Windows 7 in this demo.
You can download the developer version of this operating system from these links.
Few of the tools we would need to do malware analysis include HashCalc HxD,
Exe info PE, UPX
Bin text.
PE studio
Process monitor, regshot, autoruns, procdot and fakenet
If you are wondering what these tools do again, let me repeat that we will be learning about each of
these tools in the future module's.