Testing environment for the more serious malware analyst

[Amelith Nargothrond]

I got this setup at home, for other purposes but it can be easily applied for malware analyzing.
Take note, this is not the cheapest solution, but still a cheap, highly reliable and professional grade alternative.

Hardware: HPE ProLiant MicroServer Gen8

Software: Windows Server 2016 with Hyper-V or VMWare vSphere Hypervisor (HP customized)

Description:

• The server itself is a low-cost (really cheap) server for home and/or better said small businesses. It's awesome from many points of view, I highly recommend it. It also comes with iLO, which is the HP's implementation of a KVM, from where you can remotely control the server (update BIOS, power on, limited remote desktop and a lot more) - iLO comes from "Integrated Lights-Out".
• The server is perfectly suitable for a headless setup, which translates into low energy consumption but with a XEON processor's power. It has only one case fan, which can be noisy occasionally (at boot especially), but not that much after that. You can sleep with one powered on.
• Within iLO, you can access its "provisioning" feature, which automatically installs the OS, but also the drivers for the OS; you can also update the components firmware from here. Basically, the full installation of an OS is as easy as a few clicks, you will have the OS ready right after the first boot
• You can use 4 HDDs (in raid, with a pro grade raid controller) + 1 SSD if you like (instead of a DVD unit), so speed and space is not an issue;
• I can't speak of the vSphere solution (as I didn't try it, got other needs), but for anyone interested, it can be downloaded from here (must be the HP optimized version): https://my.vmware.com/group/vmware/details?downloadGroup=OEM-ESXI65-HPE&productId=614
• About the Server 2016 setup I could speak all day, but it's rather obvious why I recommend it:
  • multiple uses of the server (NAS, media server, FTP server etc.) with a familiar interface (Windows)
  • The server edition Hyper-V (although I like VMWare more), has its advantages: full featured hypervisor rather than VMWare player (and so why pay for others, like Workstation)
  • Because the server has 2x gigabit network adapters, you can easily use virtual switches with Hyper-V for your virtual machines (actually it has 3, but the third one is for the iLO KVM)
  • VMs -> running live malware is not a problem

Disadvantages:

• you can only install server OSs (VMware, Microsoft of Linux distros); there is absolutely no support for workstation version OSs
• HP parts (including compatible memory modules) can be expensive
• Windows Server licenses are expensive as well

Conclusions: In a small factor case, you get server-grade hardware for a headless setup, the awesome Server 2016, VMs and a lot of fun testing just about whatever you want. The server itself is cheap (considering its a server), parts can be expensive. But performance and reliability is just right for advanced home or small businesses, very well balanced.