+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: Malware Analysis Question (/showthread.php?tid=4611309)
Pages: Pages
1
2
Malware Analysis Question - Play Boy - Dec 30, 2014
I've always been interested in malware but not so much spreading and creating it, more so that I'm interested in downloading malware and running it in a VM to see how it behaves and then eventually reverse engineering it to see what makes it do so-and-so.
I know that complex malware will either kill itself or escape onto the host when in a VM environment but I want to be able to prevent this from occurring. I know the most costly method would be to get a test PC and isolate it on it's own network. But that isn't very cost effective. 😑
I believe I have all the tools I need and a bit of know how but I would like to ask your opinion. What are the chances of malware escaping from the VM onto the host machine even with no bridged connection available and how do I lessen that chance?
Thanks guys. 🤝
* - Aura - Dec 30, 2014
Make sure to disable "shared" features, such as shared network, shared files/folders, shared clipboard, shared USBs, etc. to avoid such situations. Also, I doubt you'll encounter a malware that actually escape the VM to actually infect your host system, except if you're really, really looking hard for one. However, many malware have an "Anti-VM" feature, where if they are in a VM environment, they'll behave in a legitimate way or just refuse to execute so they can't be busted.
* - Play Boy - Dec 30, 2014
(Dec 30, 2014 06:50 PM)Aurа Wrote: Make sure to disable "shared" features, such as shared network, shared files/folders, shared clipboard, shared USBs, etc. to avoid such situations. Also, I doubt you'll encounter a malware that actually escape the VM to actually infect your host system, except if you're really, really looking hard for one. However, many malware have an "Anti-VM" feature, where if they are in a VM environment, they'll behave in a legitimate way or just refuse to execute so they can't be busted.
I see. So the chances of running into such malware isn't too likely. That's great news. Thanks for the tips Aura. It's greatly appreciated. ✌
I'll also ensure to disable anything connecting the host to the VM to prevent a very unfortunate accident from occurring.
* - Wafflemonger - Dec 30, 2014
A nice cheap alternative is to get a laptop. You can get some laptops for 200-300$. You don't need super high end specs to test malware. Also note that assembly isn't that hard if you already have knowledge about malware :). As Aura said, ensure that you have all sharing off, ESPECIALLY NETWORK DISCOVERY ON THE HOST. This is a little bs thing that has almost screwed me in the past when messing with Ransomware.
* - Aura - Dec 30, 2014
(Dec 30, 2014 06:56 PM)Play Boy Wrote: I see. So the chances of running into such malware isn't too likely. That's great news. Thanks for the tips Aura. It's greatly appreciated. ✌
I'll also ensure to disable anything connecting the host to the VM to prevent a very unfortunate accident from occurring.
Hence why when someone wants me to send a file to analyze, I ask them to upload it and not to send me it on Skype, as I don't want to have that file on my host system, and also I don't want to open shared folder to transfer the file. Always better that way.
* - Play Boy - Dec 30, 2014
(Dec 30, 2014 06:58 PM)Wafflemonger Wrote: A nice cheap alternative is to get a laptop. You can get some laptops for 200-300$. You don't need super high end specs to test malware. Also note that assembly isn't that hard if you already have knowledge about malware :). As Aura said, ensure that you have all sharing off, ESPECIALLY NETWORK DISCOVERY ON THE HOST. This is a little bs thing that has almost screwed me in the past when messing with Ransomware.
Ah well. I did consider setting up a test PC. It's just money is tight right now with the start of a new semester and the holidays. I know for a fact that having such a PC would completely mitigate the risk of anything getting on my personal PC. It's a great suggestion which I may consider in the future but right now, I'm looking to be as cheap as I can. 😏
Also, if you don't mind me asking, what ransomware were you messing with? I'm actually quite interested in knowing. 🎉
(Dec 30, 2014 06:58 PM)Aurа Wrote: Hence why when someone wants me to send a file to analyze, I ask them to upload it and not to send me it on Skype, as I don't want to have that file on my host system, and also I don't want to open shared folder to transfer the file. Always better that way.
Understandable. I'm honestly paranoid enough that I get shivers running suspicious software in VMs WITH sandboxs. 🤣
So I can understand "better safe than sorry" thought process.
* - Aura - Dec 30, 2014
(Dec 30, 2014 07:10 PM)Play Boy Wrote: Ah well. I did consider setting up a test PC. It's just money is tight right now with the start of a new semester and the holidays. I know for a fact that having such a PC would completely mitigate the risk of anything getting on my personal PC. It's a great suggestion which I may consider in the future but right now, I'm looking to be as cheap as I can. 😏
Also, if you don't mind me asking, what ransomware were you messing with? I'm actually quite interested in knowing. 🎉
Understandable. I'm honestly paranoid enough that I get shivers running suspicious software in VMs WITH sandboxs. 🤣
So I can understand "better safe than sorry" thought process.
I always run the malware I receive in Sandboxie in a VM (it's just easier to see which files are being dropped, processes, etc.). Also, the VM is totally isolated and I have a snapshot of it that I restore everytime I close the VM (with all my programs, Windows Updates, settings, etc.) Best setup for me.
* - Play Boy - Dec 30, 2014
(Dec 30, 2014 07:17 PM)Aurа Wrote: I always run the malware I receive in Sandboxie in a VM (it's just easier to see which files are being dropped, processes, etc.). Also, the VM is totally isolated and I have a snapshot of it that I restore everytime I close the VM (with all my programs, Windows Updates, settings, etc.) Best setup for me.
Well now. That's an interesting idea. Though I am interested in seeing what the malware will do when it's left without a sandbox but perhaps running it in a sandbox first then running it after would actually give me a better idea of what exactly is being executed.
* - Aura - Dec 30, 2014
(Dec 30, 2014 07:31 PM)Play Boy Wrote: Well now. That's an interesting idea. Though I am interested in seeing what the malware will do when it's left without a sandbox but perhaps running it in a sandbox first then running it after would actually give me a better idea of what exactly is being executed.
Yeah. But now I can say that at least over 50% of the malicios files I get have Anti-Sandboxie feature, so it's useless. I have to rely on other tools and online analysis, lol.
* - Wafflemonger - Dec 30, 2014
(Dec 30, 2014 07:17 PM)Aurа Wrote: I always run the malware I receive in Sandboxie in a VM (it's just easier to see which files are being dropped, processes, etc.). Also, the VM is totally isolated and I have a snapshot of it that I restore everytime I close the VM (with all my programs, Windows Updates, settings, etc.) Best setup for me.
Running malware in a sandbox isn't really advised if you're doing an analysis of it as any malware you'd want to analyze wouldn't run in a sandbox ;D.
* - Aura - Dec 30, 2014
(Dec 30, 2014 07:33 PM)Wafflemonger Wrote: Running malware in a sandbox isn't really advised if you're doing an analysis of it as any malware you'd want to analyze wouldn't run in a sandbox ;D.
Read my post just above yours, haha 🤣
* - Wafflemonger - Dec 30, 2014
(Dec 30, 2014 07:35 PM)Aurа Wrote: Read my post just above yours, haha 🤣
:(...Well then :(...
Anyways OP, what was mentioned earlier should be all the information that you need :D.
* - Aura - Dec 30, 2014
(Dec 30, 2014 07:36 PM)Wafflemonger Wrote: :(...Well then :(...
Anyways OP, what was mentioned earlier should be all the information that you need :D.
I'm a minute ahead of you Waffle<3 But you're a few PLs infront of me 🤣
* - Play Boy - Dec 30, 2014
(Dec 30, 2014 07:32 PM)Aurа Wrote: Yeah. But now I can say that at least over 50% of the malicios files I get have Anti-Sandboxie feature, so it's useless. I have to rely on other tools and online analysis, lol.
Well..That's unfortunate lol.
(Dec 30, 2014 07:36 PM)Wafflemonger Wrote: :(...Well then :(...
Anyways OP, what was mentioned earlier should be all the information that you need :D.
I agree. Thanks guys. Really helped me out.
* - Aura - Dec 30, 2014
(Dec 30, 2014 07:43 PM)Play Boy Wrote: Well..That's unfortunate lol.
I agree. Thanks guys. Really helped me out.
It's alright, there's other methods to get around that. And no problem OP, good luck with that activity 🙂