Malware Analysis Environment

[mikazo]

Hi,

I'm new here and looking to get started in malware analysis. I'm just wondering, what type of environment does everyone use? Is VMware running Windows safe to analyze viruses? Do you have a dedicated "dirty" machine just for virus analysis? Do you use something like Deep Freeze to easily preserve an analysis environment? What tools are useful besides IDA, OllyDbg, Filemon, Regmon?

Thanks for any tips.

-Mike

[ratsoul]

Hi mikazo,

read here: http://zeltser.com/malware-analysis-toolkit/.

[moranned]

i use vm's to triage but also have a goat machine for analysis of vm-aware code. i route all connections from the goat through a linux gateway which allows me to control inbound and outbound connections.

[ocean]

most of the work can be done with a good VM: VMware it think it's the best right now, Virtualbox is like unusable right now because of lots of nasty bugs like hw bps not working and lots others...

tools? every tool that's needed mostly IDA, OllyDbg, the good old softice if needed, PEid+plugins, Explorer Suite, Python...