Practical Malware Analysis

Conclusion

Running and analyzing malware using VMware and virtual machines involves the following steps:

1. Start with a clean snapshot with no malware running on it.

2. Transfer the malware to the virtual machine.

3. Conduct your analysis on the virtual machine.

4. Take your notes, screenshots, and data from the virtual machine and transfer it to the physical machine.

5. Revert the virtual machine to the clean snapshot.

As new malware analysis tools are released and existing tools are updated, you will need to update your clean base image. Simply install the tools and updates, and then take a new, clean snapshot.

To analyze malware, you usually need to run the malware to observe its behavior. When running malware, you must be careful not to infect your computer or ...