Konfigurimi i Laboratorit të Sigurt

Dynamic analysis means running a sample and observing its behavior, which is inherently risky: any mistake can compromise the analyst's own machine or leak data to the internet.

A safe lab is isolated from your host and from any network you care about. The usual design is a virtual machine (VirtualBox, VMware Workstation, Hyper-V) with snapshots, running a Windows 10 or 11 guest pre-installed with analysis tools: Process Monitor, Process Hacker, Wireshark, FakeNet-NG, Regshot, Autoruns, sysmon and Cuckoo or CAPE agent. The VM has no shared folders, no clipboard sync and no host network adapter while analyzing. Instead, network traffic is routed through a second VM that runs INetSim or FakeDNS to simulate internet services without the sample actually reaching the real internet. Before running a sample, take a clean snapshot. After the run, revert and repeat for reproducibility. Never run samples on a laptop connected to your home or office network. Be aware of VM-detection techniques: modern malware checks for VirtualBox hypervisor artifacts, unusual CPU counts, missing user activity, and specific registry keys; hardened lab builds use tools like anti-anti-VM patches and bare-metal systems with imaging for reset. For organizations, commercial sandboxes like Joe Sandbox, Hybrid Analysis and VMRay run samples at scale and produce detailed reports. A student can start with Any.Run, which offers an interactive browser-based sandbox free for basic use. Either way, the principle is the same: isolate, observe, revert.

Komponentet:

• REMnux (Linux për analizë malware).
• FLARE-VM (Windows analyst VM).
• Hypervisor: VirtualBox / VMware / Proxmox.
• Rrjet i izoluar: host-only + INetSim ose FakeDNS.

Izolim me INetSim për të simuluar internet:

# /etc/inetsim/inetsim.conf
start_service http
start_service dns
start_service smtp
service_bind_address 10.0.0.1

VirtualBox snapshot para ekzekutimit:

VBoxManage snapshot FLARE-VM take clean-baseline
VBoxManage snapshot FLARE-VM restore clean-baseline  # pas analizës

1. Ndërto një lab me 2 VM: REMnux (gateway + INetSim) dhe FLARE-VM (detonation).
2. Verifiko se FLARE-VM nuk mund të arrijë internet real.

• Lenny Zeltser — Building a Malware Analysis Lab.
• FLARE-VM GitHub.