Everybody, I'm Aaron Rosenmund. I'm here with Tyler Hudak, doing a
Play by Play on Setting Up a Malware Analysis Lab.
We're doing this so that you guys can follow along not
just with setting up this initial lab,
but also with follow‑on Play by Plays we're going to do on current malware.
And I really want to get started, Tyler, with why are we
setting up a lab in the first place?
I know there's other solutions. Why do we want to set up
our own lab, and what's the purpose here?
‑Sure.
So, you want to set up your own malware analysis lab because at some point,
if you do use automated tools that are online or toolsets that are available,
they're going to fail on you,
and they don't give you as much interactivity as you would with
normally going in and actually setting up your own system.
Setting up your own system, you have full control over it.
You know how it's set up.
You know that if it's going to fail,
how it's going to fail and what limitations that you have.
‑And maybe there's even interesting aspects in how it fails.
‑Exactly.
‑See that happen. Yeah, because I've used VirusTotal and Hybrid Analysis and
ANY.RUN, and ANY.RUN is pretty good in that you can kind of see what's
happening on kind of a "live box", right? ‑Right.
‑But at the same time, it doesn't go as far as when I've
detonated malware in my own sandbox.
‑Exactly. And the thing you have to remember too
with the online public sandboxes,
like any running VirusTotal, you upload something, that
information is publicly available.
It could be shared with other researchers.
So if you get attacked by a targeted piece of malware,
you may not want to have the world know that that was sent to
you, or you may not even want the attackers to know that you're
analyzing their malware, so you need your own sandbox in order
to analyze this stuff.
‑Oh yeah, that is a really good point for keeping it
private and kind of intel gain loss.
‑Right?
Exactly.
‑For your own malware analysis team.