Hack Forums
[BHCPU] Brotherhood academy lesson 1: Setting up a malware test box - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [BHCPU] Brotherhood academy lesson 1: Setting up a malware test box (/showthread.php?tid=4260010)

Pages: Pages 1 2 3

[BHCPU] Brotherhood academy lesson 1: Setting up a malware test box - -Hyperion - Jun 1, 2014

[Image: 9UztjKs.png]
Hey guys it's -Hyperion ✌ I have run my own security company doing pen testing and malware removal the past 3 years. I am also a part of the WHHPIT team.

This is part 1 of a 3 part series on analyzing malware and removing it.
Introduction
Part 1. Setting up a malware test box
Part 2. Analyzing malware
Part 3. Removing malware

Requirements
  • Virtual Box:Here

  • Windows XP with SP3( you can download this from various sites if you do not have a CD)

  • Malware Analysis/Removal Toolkit: Here



Setting up the Test Box
I will refer you to this thread Here for setting up a virtual machine. After you have windows XP installed there are a few things to do first to change first.

Start by launching VM and clicking on setting.
PICTURE
Spoiler (Click to View)

Then navigate to Network.
PICTURE
Spoiler (Click to View)

Finally enable Bridged Networking.
PICTURE
Spoiler (Click to View)

That is the only setting that needs to be changed. Now you can boot up the virtual machine. Once loaded into XP there are 3 things you need to do.

First update windows and turn off AV by going to Security Center.
PICTURE
Spoiler (Click to View)

Second select "Check for the latest updates from Windows Update" and then click on Recommendations and choose I have my AV software.
PICTURE
Spoiler (Click to View)

Go Here and run the installer.

Last is to download and install the programs in the Toolkit that need installing and placing the others on the Desktop.

Now you can restart the VM then turn it off.

Creating a snapshot of the Test Box

Now I will walk your through taking a snapshot of the VM. You will restore to this snapshot after every file you test. This will take the VM back to its state before you tested anything allowing you a clean environment each time and a back up if something goes wrong.

First click on the snapshot button with the machine powered off.
PICTURE
Spoiler (Click to View)

Then click on Take Snapshot.
PICTURE
Spoiler (Click to View)

Finally type in a name and description then hit okay.
PICTURE
Spoiler (Click to View)

To restore to this snapshot any time you power off the machine just select restore.
PICTURE
Spoiler (Click to View)

Conclusion
That's it you now have a test box set up with all the necessary tools and a way to restore after each test. In lesson 2 we will go over using these tools and analyzing a piece of malware. Stay tuned 🎉


* - Jagster™ - Jun 1, 2014

Nice work buddy cant wait to see the other 2 parts of this series!

* - -zERAiT - Jun 1, 2014

Great work, can't wait to see the other parts!

-zERAiT🤝

* - Ｔ ｅ ｓ ｓ ｅ ｒ ａ ｃ ｔ - Jun 1, 2014

I like this tutorial, I support Virtual Machine use. HF users should do it more often, however, I support VMware over all other vendors. You just can't beat them.

* - cyberducky - Jun 1, 2014

(Jun 1, 2014 02:05 PM)MaiTriCks Wrote:  I like this tutorial, I support Virtual Machine use. HF users should do it more often, however, I support VMware over all other vendors. You just can't beat them.

VirtualBox is good for simple users but VMWare has a boat load of features.

* - Mittens - Jun 1, 2014

Thanks for this tutorial, I always wondered how members tested files on a virtual machine.

* - Roger Waters - Jun 1, 2014

Nice tutorial, -Hyperion. Hope to see some more tutorials like this from you.

* - Aura - Jun 1, 2014

(Jun 1, 2014 02:19 PM)Mittens Wrote:  Thanks for this tutorial, I always wondered how members tested files on a virtual machine.

All the smart one does. The WHHPIT at least do and the common helpers here too 😝

* - Abdilo - Jun 10, 2014

I did this a few weeks ago when i accidently infected my self, I found the guys ip address and I geolocated his ip and spammed the keylog file till the keylog file was 30mb then i waited for him to connect and download the 30mb keylog file... then i removed the virus from my virtual machine :P

* - Ｔ ｅ ｓ ｓ ｅ ｒ ａ ｃ ｔ - Jun 10, 2014

(Jun 10, 2014 03:52 AM)Grey Hat Mafias Bitch Wrote:  I did this a few weeks ago when i accidently infected my self, I found the guys ip address and I geolocated his ip and spammed the keylog file till the keylog file was 30mb then i waited for him to connect and download the 30mb keylog file... then i removed the virus from my virtual machine :P

That is so rude to the poor phisher. Why would you do that? 😠

Jk. 😏 That was pretty cool. You should have made the file 1GB and let it go spam overnight next time.

* - Darc - Jun 10, 2014

I really like this tutorial. I really like Virtual Machines and this is a really good tutorial. My favorite VM is VMware but there are other great ones out there.

* - kingpin69 - Jun 10, 2014

anyone got a link for just a straight up .iso of xp sp3?

all i can seem to find is zip files with setup.exe inside 😠

* - ihearyou - Jun 11, 2014

Just be care if you bridge your connection, You can still infect the host which is VM's are running on. I use Vmware Workstation and i Vlan the box off so there is no communication to any other PC's on my network.

* - -Hyperion - Jun 11, 2014

(Jun 11, 2014 01:24 AM)ihearyou Wrote:  Just be care if you bridge your connection, You can still infect the host which is VM's are running on. I use Vmware Workstation and i Vlan the box off so there is no communication to any other PC's on my network.

This is a test box I specifically set it up as a bridged connection for monitoring purposes.

* - Abdilo - Jun 11, 2014

(Jun 11, 2014 06:06 AM)-Hyperion Wrote:  This is a test box I specifically set it up as a bridged connection for monitoring purposes.
You could setup fakenet on your host computer then bridge the connections through that.
Or what I do is lock it to a dmz and use fiddler to mess with the traffic :P