Complete Malware Analysis VM Image
Complete Malware Analysis VM Image

is there a complate malware analysis vm image that contains most of the decompilers, PE analysers, debuggers, monitoring tools, etc..

thanks!!

p.s. i know that there is flare VM that is free to install but it seems not complete.
🗣darkalimdor18

There’s no “complete” and “most perfect” image, new tools and plugins are published every day and no one can keep up with them all.
You should be able to customize your own image based on your own needs and most importantly skills, there’s no need to downloaded tons of tools and you barely know anything about most of them.
👤MO12400

I would do two things: install something like Remnux and use it as a “wall”. Then install something like Flare to start learning what you like. Eventually either tweak it to your liking, or build an image with your own stuff. Knowing how to install it and configure it is invaluable knowledge. Plus you can then learn other apps to auto-build VMs of your choice with customizations you need for types of malware you are analyzing.

Route all traffic through Remnux. You can then drop traffic outbound but still capture traffic, use Burpe Suite and other tools to dynamically identify C2 and communications safely.
👤FlaccidKraken

Yeah I second REMnux, it’s native Linux but there’s also a Windows version if you can find someone who has taken the GREM. The Windows one is called REMnux Workstation.
👤Th3_Pr0f3ss0r


🎖@malwr

Open Source Archive of Legal Threats Made Against Genuine Security Researchers (Creative Commons!)
🗣docker-osx

Add Steam to that list for the recent issue brought up.
👤drimgere

Let this be a wakeup call to everyone to always keep in mind that companies can and might screw you over despite your good intentions and protect yourselves accordingly.
👤267aa37673a9fa659490

This list has to be taken with a huge grain of salt as researcher sometimes try to paint themselves in a much nicer way that what really happened. The Skytech entry is a pretty example of this as I know a little bit the inside of it. The "researcher" received threat from the company not because he disclosed a vulnerability, but because he DoSed the company system from the Dawson network connection. The fact that he disclosed a vulnerability before had nothing to do with the threat he received. Also a lot of the threat he received where not from Skytech, but from Dawson. The reason ? He continued to "test" the school internal system (that didn't belong to Skytech) after being told to stop.
👤Cold-Mix357


🎖@malwr

[Report M-Trends 2021](https://content.fireeye.com/m-trends/rpt-m-trends-2021)
🗣digicat


🎖@malwr

Microsoft 365 Dev subscriptions free with Dev Essentials (also free)
🗣cryolithic

I’m going to make so many word documents it will be like a 730 day trial
👤Jaimz22

Only 90 day trial
👤xxbiohazrdxx

I saw they added what seems like a slew of additional freebies.
👤nameandfaceless


🎖@malwr

ATT SMS record analysis
I've been asked to provide some analysis of SMS records which were subpoenaed from the carrier but am having a little trouble resolving a few things. There are several messages from a two digit phone number and several instances where two or three messages were sent by the phone at the exact same time (down to the second). It appears to me that the messages sent at the same time were likely long messages broken up into 2 or 3 messages due to character limits, but I can't really come up with anything that would allow a two digit phone number to deliver messages. Any help would be greatly appreciated.
🗣kstewart0x00

I often find that those records reflect carrier services, like paying a bill, checking data plan current usage, and messages regarding the account.

If you received this data in a subpoena return, there should be a document explaining these numbers. When in doubt, I usually call the division that supplied the records.
👤chilledquesadilla

Could they be something that came from AT&T?

Is it from a service? or is it a conversation?

Here's someone asking AT&T the same question about messages on their bill. And AT&T providing stellar customer service, too.

https://forums.att.com/conversations/wireless-account/2-digit-phone-number/5defd200bad5f2f606f76a5c
👤technologite


🎖@malwr

How to monitor in real-time for SSH sessions
Blog post on how to monitor in real-time for SSH sessions: https://cryptsus.com/blog/ssh-security-siem-dashboard-kibana.html
🗣krabelize


🎖@malwr

Endpoint Discovery - Navigating your way through unmanaged devices
🗣digicat

This is pretty awesome.
👤m0wax


🎖@malwr

Disables the Windows Platform Binary Table (WPBT) in your firmware. This program use a non-permenant, non-destructive method to remove the table from system memory, so it should be executed every time the computer is rebooted before Windows bootloader starts. - sophisticated UEFI implant mitigation
🗣digicat

This would be such a pain in the ass to deploy on one machine, let alone an entire enterprise
👤edward_snowedin

>Because this feature provides the ability to persistently execute system software in the context of Windows, it becomes critical that WPBT-based solutions are as secure as possible and do not expose Windows users to exploitable conditions. In particular, WPBT solutions must not include malware (i.e., malicious software or unwanted software installed without adequate user consent).

Basically this is a catch-22 situation. This tablet could be used for legitimate purposes like loading antitheft software OR it could be used to load malware persistently
👤CrowGrandFather


🎖@malwr

Compromised Linux VM for DF training?
Does anyone have a vmdk of a compromised Linux host (perhaps from a Honeypot?) they'd be willing to share? I'd like to have my blue team try their hand at manual forensics as a table-top / Forensics Capture-the-Flag exercise

Plans:
\- Have them import it into Virtualbox (they all use Ubuntu as their workstations)
\- Browse around the host and see what they can find manually first
\- Utilize something like Plaso / log2timeline and import it into a log tool like Splunk
🗣AbracaBOOYAH

Not exactly what you are looking for but I was just at a competition last week and it had some forensic CTFs. Found them here, might be what you are interested in.
👤AppCompatCache-SI-TS

Just infect a Linux vm
👤Stofers

The Great Hal Pomeranz made a course, with resources from Ali Hadi/Champlain College, that might help you out:
https://archive.org/download/HalLinuxForensics
https://github.com/ashemery/LinuxForensics
👤awk_warden


🎖@malwr

[Video Makop Ransomware - Decrypting the Encrypted Section](https://youtu.be/mlIRoGrxrmA)
🗣Struppigel


🎖@malwr