Reply to thread

Message

<blockquote data-quote="hunter44" data-source="post: 975375" data-attributes="member: 94311">Understand.One more thing which came to my mind when I watched your video. As I see, you have normal internet connection from your VM where you&#039;re inspecting malware. Is it a common thing or it depends on the type of malware which is under investigation? Personally, I closed internet connection from my windows VM, it can only communicates with REMnux machine to look at network traffic there. Most of tutorials, videos, articles I read, also told that it should be first thing to do - do not connect your VM with internet.I downloaded samples to my host and just move them to VM to open there. Maybe I should always do that on VM? I&#039;m just wondering what if I want to get some reports from dynamic sandboxes? Should I open a connection in VM to AnyRun or othet tool online?I also don&#039;t think so, every malware completely forbids using internet during analyze, but if you could elaborate on it and explain when it is really safe to run sample with internet connection turned on and when not.Also one more question - do you recommend some books of malware analysing? I already read &quot;Practical Malware Analysis&quot; Sikorski, Honig, but maybe there are some worth books to read in this topic.</blockquote>

[QUOTE="hunter44, post: 975375, member: 94311"] Understand. One more thing which came to my mind when I watched your video. As I see, you have normal internet connection from your VM where you're inspecting malware. Is it a common thing or it depends on the type of malware which is under investigation? Personally, I closed internet connection from my windows VM, it can only communicates with REMnux machine to look at network traffic there. Most of tutorials, videos, articles I read, also told that it should be first thing to do - [I]do not connect your VM with internet[/I]. I downloaded samples to my host and just move them to VM to open there. Maybe I should always do that on VM? I'm just wondering what if I want to get some reports from dynamic sandboxes? Should I open a connection in VM to AnyRun or othet tool online? I also don't think so, every malware completely forbids using internet during analyze, but if you could elaborate on it and explain when it is really safe to run sample with internet connection turned on and when not. Also one more question - do you recommend some books of malware analysing? I already read "Practical Malware Analysis" Sikorski, Honig, but maybe there are some worth books to read in this topic. [/QUOTE]

Verification