Build a Malware Analysis Lab (Self-Hosted & Cloud) - The Malware Analysis Project 101

[@foolish3art]

I have an interest in CyberSecurity and a Network Pro + certification but I am by no means an expert. This video helped me fill in some gaps in my knowledge without being so advanced that it's impossible to understand

[@xxnoobxx1900]

I have no idea what any of this is but I think its really cool

[@TheIntermediatePianist]

lol

[@orlando1574]

Seen your newest upload just 18 min ago. Hows this notification that this video came up on me feed. Thanks mate. Love this vid. It gave me afew ideas for malware work. Pretty hecas to be fair.

[@GSAUS]

This is a great setup. I ran a couple of malware analysis labs (on-prem and remote) for almost two decades and there was a lot of overlap with what you've done here. My setup of choice was using ESXi, virtualising a firewall, and then building the clients behind that. I love the flexibility of your cloud based setup though.

[@collinsinfosec]

Interesting choice! Did you have a dedicated server running ESXi? The cloud-based lab was fun to build.

[@GSAUS]

@@collinsinfosec We were using dedicated servers. My team was spread all over the globe, so we built one in each continent where we had people. 20 years ago latency on international routing was a bit more of an issue than it is now.

[@bobcoderz]

Great Work 👍

[@orlando1574]

Im so gonna use this RDP application for ny work. Ur the best

[@amolwanave]

Great demo! I was able to follow along and set up the lab in cloud. Although I am curious if AWS allows malware analysis in their environment? Do we need explicit approval from AWS to do so?

[@sandamalgamage1242]

Great vedio brother ❤❤

[@sonuzeldar7963]

how we are going to test the self-hosted labs ? i mean how to do analysis

[@guilherme5094]

👍👍Thanks man!

[@lancemarchetti8673]

Cool Grant... thanks man

[@lynxtouch]

Should the EBS volume and snapshots be destroyed when you run the terraform destroy command? I've still got the EBS volume and the snapshot running

[@lPlanetarizado]

this looks alot easier that configuring cuckoo3; i know cuckoo3 its kind of different because its sutomatic analysis, but this looks better for me

[@akashg6999]

Anyone knows the after use of setting the lab??? Like using actual malware in the flarevm to know it’s working of detection/analysis

[@anantP-ip8op]

Hi, are there enough jobs in malware analysis domain? What's the future of this domain as SOAR and automation comes in

[@collinsinfosec]

It depends on the where you are applying. Security vendors with threat intelligence and research teams will be needed. I wouldn't say there is a huge need for malware analysts compared to SOC analysts or security engineers. It's a great skill to learn regardless of your day job.

[@Trilipop]

How would one safely download/import malware samples into those lab setups? Whether its host-based or cloud-based. Thanks

[@Matt-ir1ky]

The samples normally come as zipped files with a password like "malware" or "infected". This way they can't be accidently executed until you've put them on your malware analysis machine. You can just download them directly if you have internet access on your malware box too.

[@aalokydv8310]

i tried setting it up on VMWare workstation and everything went smoothly until setting up a host only network, how do we do that in VMWare workstation pro?

[@HAFIZFARHAD-f5d]

Same question..

[@mahetsiedahi6530]

Hello, does anyone know why the "install" file is not generated on the desktop? ...and thnks Grant for this gread work

[@jeffreyb4193]

I had the same issue. If you copied the link in the description it is incomplete when I pasted in the FlareVM powershell console. I just clicked on it in the description and copied the URL from the window that popped up and pasted it in the powershell window.

[@zackerymcallister9057]

I followed all the steps and after the .\install.ps1 was executed in powershell the flare vm is not showing up on my screen it is my regular windows background. How would I know if it was downloaded correctly? Any help is appreciated.

[@Dontcarehowyoufeel]

Hello, quick question why did you run JQ, Terraform, and AWSCLI from an ubuntu?

[@collinsinfosec]

I am using Windows Subsystem For Linux.

[@martiantv4360]

I have a question your running your ubuntu in windows or in virtual box? I got confused for these part

[@gayatrinakar5049]

@@martiantv4360 Im still lost at this part

[@hammazahmed1289]

Just a quick question, I will soon be starting this tutorial, can I give around 40 gigs of space instead of 75? My laptop sucks. :(

[@collinsinfosec]

40 Gigabytes should be enough for this project!

[@hammazahmed1289]

@@collinsinfosec thank you.

[@JasonRamirez-x3k]

Im enjoying doing this project but im running into an issue with connecting REMnux and FlareVM. When I run ipconfig in powershell I get the ipv4 address 10.0.0.3 and when i run a ping test in power shell with ip 10.0.0.3 it comes back successful but when i run 10.0.0.4 in powershell it comes back with a request timed out and Lost=4. When i run "ping 10.0.0.4" or "ping 10.0.0.3" in REMnux it says "Network is unreachable". When I run ipconfig in REMnux the inet address is 127.0.0.1. I tried rewatching the video and starting from the beginning but I'm stumped on what to do. This is my first malware analysis so i want to make sure everything is correct before moving forward. Any suggestions?

[@otakusenpai8134]

same issue mate no fix yet i guess'

[@foolish3art]

@@otakusenpai8134 The fix is learning the basics of networking and Linux. The "problem" isn't something someone else can fix for you. Although one possible solution is seeking out a mentor for help

[@na0]

I had the same issue, and in my case, the network interface on REMnux was off by default. The network interface is named something like "enp0s#", which might be different for you. Here’s how I fixed it for my interface "enp0s17": 1. Brought up the interface using: sudo ip link set enp0s17 up 2. Checked the status with the command: ip addr show enp0s17 This showed that the state changed to "UP". 3. Edited the netplan configuration file: sudo nano /etc/netplan/01-netcfg.yaml Ensure it looks like this to use DHCP: network: version: 2 ethernets: enp0s17: dhcp4: yes 4. Applied the netplan configuration with: sudo netplan apply 5. Verified if it obtained an IP address: ip addr show enp0s17 It should show an IP address. 6. For FlareVM, set the gateway/DNS similar to your REMnux IP (from the previous command). FlareVM IP will need to be different (e.g., FlareVM 10.0.0.3 | REMnux 10.0.0.4 ). Note: Before doing all this, make sure both machines are using "host only adapter" and that you created the network adapter shown at 25:20 in the video.

[@SpartaYoshi]

@@na0 thank you so much! i had this issue before, this worked for me :)

[@recon0x7f16]

I did all the network setup correctly can’t reach jost

[@philradon5794]

i went over it 2 more times i cannot ping the remnux mashine and vice versa, Any troubleshooting advice ?

[@collinsinfosec]

If you are on VirtualBox, make sure you are using Host-Only Adapter and using the same Ethernet Adapter under the Name section. Something similar to "VirtualBox Host-Only Ethernet Adapter #2".

[@philradon5794]

@@collinsinfosec hey thanks for the Quick reply, definitely followed your instructions to use of Host only and use the same adapert for both Boxes.... Happy new year !

[@philradon5794]

i got it, i had to set the remnux interface to the desired ip addr. and bring it up and now i can ping the mashines

[@tmz-pwn]

hey what did you end up setting remnux IP addr to? @@philradon5794

[@tmz-pwn]

@collinsinfosec

[@jivantsnow4356]

could'nt insert addition guest cs image

[@aminel2a]

good job 👏, +1sub

[@KoladeM-Kuye]

The remote server returned an error: (404) Not found when trying to install flareVM.

[@AdolfSey]

Got the same issue. Did you find solution. If yes, please share with me . Thanks

[@SpacemanPaco]

you will also have to replace the install.ps1 script that gets pulled with the new one on the URL i provided

[@Savoyyaboy]

I keep getting the same message it’s an error

[@Unknown-he3gz]

Guys i didn't get network in Windows flare VM says No Internet

[@ayomikunlawal5099]

I tried setting up the Flare Vm , following each step but it keeps saying please disbale windows defender through group policy after i have diabled all

[@salmaalbarwani3638]

i have same problem idk what to do

[@nickmullen9510]

why did you skip over disabling updates or fully turning off defender in group policy?

[@frankthe_8328]

i get .404 error for installing FlareVM someone help

[@riteshpatil4289]

same here did u get any solution

[@ANTGPRO]

👍

[@shannonbabar1659]

This this possible in qemu/kvm

[@koh8614]

I think so