Using Your Malware Analysis Machine
To exercise the functionality of your subject malware as much as possible, you must simulate all network services on which the malware relies. For example, malware commonly connects to an HTTP server to download additional malware. To observe this activity, you’ll need to give the malware access to a Domain Name System (DNS) server to resolve the server’s IP address, as well as an HTTP server to respond to requests. With the custom network configuration just described, the machine providing services should be running the services required for the malware to communicate. (We’ll discuss a variety of tools useful for simulating network services in the next chapter.)
Connecting Malware to the Internet
Sometimes you’ll ...
Get Practical Malware Analysis now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.