Building a Free Malware Lab

Welcome to rinse and REpeat analysis!  What better way to start a blog than to begin with recommendations for starting up an environment for Malware Analysis.

Here is a list of what tools I recommend downloading:

1. Virtualization software - VMware Workstation Player or VirtualBox




1. This will allow us to perform analysis in a safe/isolated environment


2. VMware is preferred but VirtualBox will also do the job! 




2. Windows 7 Image




1. Most malware is written for Windows and we must provide it with the right environment for it to run correctly




1. List of tools to download for this VM:




1. Exeinfo


2. PEID


3. PEView


4. PEStudio


5. Resource Hacker


6. HxD


7. Process Monitor


8. Process Hacker


9. Autoruns


10. RegShot


11. API Monitor


12. FakeNet


13. Apate DNS


14. WinPcap


15. Wireshark


16. IDAPro (idafree)


17. Ollydbg


18. x64Dbg


19. Python


20. PyCharm








3. REMnux




1. This is a free VM/fully loaded Linux-based toolkit with tons of amazing tools for analyzing malware


2. Primarily for static analysis


3. Tons of python scripts to run against malware


4. Especially awesome for deobfuscation, malicious PS/VB scripts, shellcode, etc... 




4. SIFT Workstation




1. This is a free VM/fully loaded Linux-based toolkit with tons of amazing tools for forensics


2. Can be used to analyze malware forensically


3. Identify artifacts that malware leaves on disk


4. Analyze evasive fileless malware that doesn't touch disk


5. Easily spot code injection, API hooks, and rootkits




5. Kali Linux




1. This is a free VM/fully loaded Linux-based toolkit with tons of amazing tools for penetration testing


2. Recreate compromises, create and deploy payloads


3. Think like the adversary