Skip to content

Latest commit

 

History

History
34 lines (20 loc) · 2.76 KB

4-Malware-Analysis-Lab.md

File metadata and controls

34 lines (20 loc) · 2.76 KB

Malware Analysis Virtual Environment

REMnux

REMnux® is a free Linux toolkit for assisting malware analysts with reverse-engineering malicious software. It strives to make it easier for forensic investigators and incident responders to start using the variety of freely-available tools that can examine malware, yet might be difficult to locate or set up.

The heart of the project is the REMnux Linux distribution based on Ubuntu. This lightweight distro incorporates many tools for analyzing Windows and Linux malware, examining browser-based threats such as obfuscated JavaScript, exploring suspicious document files and taking apart other malicious artifacts. Investigators can also use the distro to intercept suspicious network traffic in an isolated lab when performing behavioral malware analysis.

https://remnux.org/

Tsurugi Linux

Tsurugi Linux is a new heavily customized Linux distribution (first release 03/Nov/2018 at AvTokyo security conference in Japan) based on Ubuntu 16LTS version (64-bit with the new 5.4.2 custom kernel) and is designed to support DFIR investigations, malware analysis and OSINT activities.

https://tsurugi-linux.org/

FLARE VM

FLARE VM is a freely available and open sourced Windows-based security distribution designed for reverse engineers, malware analysts, incident responders, forensicators, and penetration testers. Inspired by open-source Linux-based security distributions like Kali Linux, REMnux and others, FLARE VM delivers a fully configured platform with a comprehensive collection of Windows security tools such as debuggers, disassemblers, decompilers, static and dynamic analysis utilities, network analysis and manipulation, web assessment, exploitation, vulnerability assessment applications, and many others.

FLARE VM

Setup the Flare VM Environment

The process is very simple, make sure to download the FLARE VM on official GitHub repository by FireEye, and the Windows 7 virtual machine.

The setup is very easy, just fire up your fresh new Windows 7 VM and install the Flare VM PS scripts. I separeted some useful links on setting up the FLARE VM.