Learning Malware Analysis

3.5 Simulating Services with INetSim

Most malware, when executed, reach out to the internet (command and control server), and it is not a good idea to allow the malware to connect to its C2 server, and also sometimes these servers may be unavailable. During malware analysis, you need to determine the behavior of the malware without allowing it to contact the actual command and control (C2) server, but at the same time, you need to provide all the services required by the malware so that it can continue its operation.

INetSim is a free Linux-based software suite for simulating standard internet services (such as DNS, HTTP/HTTPS, and so on). The steps to install and configure INetSim on the Linux VM were covered in Chapter 1, Introduction to ...