Re:MalwareBazaar – Malware Sample Exchange
by thomasdub on Wednesday September 23, 2020 @04:21PM
(#24571512)
This is quite dangerous unless you know what you’re doing, if you execute the malware then plan to throw away all equipment you’re using to analyze it. For a next-best experience, if you’re curious, you should upload one to an online malware sandbox e.g. app.any.run which allows you interact with it, look at network traffic, inspect file mods etc. - all the fun, much much less risk and hassle!
[ Parent
| on HN ]
Re:MalwareBazaar – Malware Sample Exchange
by arsome on Wednesday September 23, 2020 @07:23PM
(#24573448)
Be careful if you're trusting any of those sandbox services for accurate results though - some malware is able to detect the VM they're running in and refuse to run the malicious payload. Often times legitimate cracks will be distributed on sources like Usenet using a "binder" to attach the malicious payload the an otherwise perfectly fine crack.
As a side note, for some reason, there's way more malware on usenet than bittorrent, I've even found it on games on major NZB sites, possibly just due to the seed counts weeding out the malicious ones via simple popularity in the public bittorrent world.
Re:MalwareBazaar – Malware Sample Exchange
by voltagex_ on Wednesday September 23, 2020 @07:37PM
(#24573564)
> if you execute the malware then plan to throw away all equipment you’re using to analyze it
I'm not sure your run of the mill malware is doing anything that can't be fixed by a format and reinstall, but yes, use an isolated VM.
Re:MalwareBazaar – Malware Sample Exchange
by secfirstmd on Wednesday September 23, 2020 @08:06PM
(#24573785)
Cuckoo Sandbox is a decent self hosted tool for analysing malware. Though a complete pain to setup. Even with some of the scripts making parts of it easier.