Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

Chapter 7. Malware Labs

Malware labs can be extremely simple or very complex. It all depends on your available resources (such as hardware, networking equipment, Windows licenses, and so on), how much of the analysis you want to automate, and how many options you want to have available. This chapter shows you how to set up a small, personal lab that consists of virtual targets and physical targets using real or simulated Internet. Figure 7-1 shows an example of a lab environment. It consists of the following components:

• Physical targets: These are Windows-based physical computers on which you'll execute malware. Don't worry about infecting the physical computers. You can prevent them from being infected with Deep Freeze, or you can quickly re-image them using solutions such as Truman and FOG. When FOG is discussed in Recipe 7-8, these physical targets are referred to as FOG clients. Of course, physical machines aren't required, but it's nice to have them available in case you need to analyze VM-aware malware.

• Virtual targets: These are Windows-based virtual machines on which you'll execute malware. Once you're done, you can revert them back to the pre-infection state. We recommend that you have at least one or two VMs running different versions of Windows. Throughout this chapter, we refer to virtual targets as virtual machine guests and VMs.

• Controller: This is a Linux-based physical computer. It runs imaging software to control the physical targets, virtualization software (such ...