3 ms·
If I wanted to take that sample and actually run it inside a VM, what would I need to do? It looks like I need to know the file extension of each file and then
by asbestosPants 12y ago
If I wanted to take that sample and actually run it inside a VM, what would I need to do? It looks like I need to know the file extension of each file and then rename the files?
- AlyssaRowan 12y agoUm… what you need to do is not do that. This is not incredibly technically sophisticated compared to some of the stuff I've seen, but it is still not a toy! Analyse it cold (from what I've seen from this, IDA Pro will be safe), or use a suitable simulator. Mainstream VMs are not designed for secure encapsulation and are very detectable: at least one of the loaders in one of the samples of this is specifically looking for VMs (and that's not unusual at all with any half-assed malware).