Lab notes: building a safe malware-analysis VM in 2026

Please keep the hashes and drop the mystery zips. You wrote «Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a». That is the sentence I keep. Tools snapshot in 8 minutes or you will not restore it. My note id for this: 101-00.

@connectpro

Please keep the hashes and drop the mystery zips. You wrote «Host-only NIC, no shared folders, no drag-drop, snapshots before every detonati

You are treating a checksum as a signature again. If you only have the decompiler, you do not have the bug. You wrote «Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a». That is the sentence I keep. Tools snapshot in 8 minutes or you will not restore it. If anyone DMs me a zip I will not open it. Hash in-thread.

@echo

Bookmarking this for the lab wiki. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-dr

Did this on ARM64 last week — same shape, different pain. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Same class as the June thread, different binary.

Bookmarking this for the lab wiki. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. PE-sieve is a lead. It is not a verdict. Took me 12 hours the first time.

The screenshot is the useful part of the post. You wrote «Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a». That is the sentence I keep. Transfer samples as a hashed read-only ISO. Not drag-drop. If anyone DMs me a zip I will not open it. Hash in-thread.

Not fully convinced yet. You wrote «Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. What did you key the join on — PID or process GUID? My note id for this: 101-08.

@davidxo

The screenshot is the useful part of the post. You wrote «Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation,

You skipped isolation and then asked why the box is dirty. That is on you. Bookmarking this for the lab wiki. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Clipboard off on the detonation VM. I pasted a token once. Did you force-create the function or did auto-analysis luck into it? I wrote a 12-line script and then threw it away. The listing was enough.

@index

Came back to this after a coffee. Still hold. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders,

Good. Dated shot, version in the post. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Clipboard off on the detonation VM. I pasted a token once. Same class as the October thread, different binary.

@ethanzone

Did this on ARM64 last week — same shape, different pain. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only

I am not moving this to DMs so you can yell. Stay on the class. Please keep the hashes and drop the mystery zips. The load-bearing line: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Dirty VM means throw it. Do not apt upgrade a dirty box. Took me 6 hours the first time.

@lanrepro

Quietly the best note on this board this month. The load-bearing line: Host-only NIC, no shared folders, no drag-drop, snapshots before ever

Do not call people skids because they use Ghidra. Not fully convinced yet. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Dirty VM means throw it. Do not apt upgrade a dirty box. After you did that, did the decompiler pick it up or did you dump? My note id for this: 101-13.

@gate

Bookmarking this for the lab wiki. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only NIC, no shared folders,

That is not what the listing shows. You are arguing a vibe. I want the listing, not the decompiler story. You wrote «Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I wrote a 12-line script and then threw it away. The listing was enough.

This matches a public n-day class from last patch Tuesday. The load-bearing line: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. PE-sieve is a lead. It is not a verdict. If anyone DMs me a zip I will not open it. Hash in-thread.

@hexor

Not fully convinced yet. You wrote «Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-wa

I read the patch. You read a tweet. Those are not the same source. Came back to this after a coffee. Still hold. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Transfer samples as a hashed read-only ISO. Not drag-drop. I will +rep a listing and −rep a vibe. That is the deal.

@jerrycool

Good. Dated shot, version in the post. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no dra

Call-convention guess is not evidence. I disagree with the tone, not the bytes. The load-bearing line: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Transfer samples as a hashed read-only ISO. Not drag-drop. My note id for this: 101-11.

Quietly the best note on this board this month. The load-bearing line: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Version in my shot: current lab snapshot, not last year's blog.

Also: Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week.

@modx

This matches a public n-day class from last patch Tuesday. The load-bearing line: Host-only NIC, no shared folders, no drag-drop, snapshots

You are describing a live target. Stop. Patched class only. I disagree with the tone, not the bytes. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I wrote a 12-line script and then threw it away. The listing was enough.

@nodes

I disagree with the tone, not the bytes. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no d

I want the listing, not the decompiler story. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I reproduced it on lab build 1174.

@opsec

I want the listing, not the decompiler story. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders,

Take the telegram pitch to the bin. Market listing or nothing. Please keep the hashes and drop the mystery zips. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. PE-sieve is a lead. It is not a verdict. I will +rep a listing and −rep a vibe. That is the deal.

Not fully convinced yet. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. FakeNet that can reach the internet is not a simulator. Hash of the public file, or are we arguing a shape? I reproduced it on lab build 1229.

@realkenny

Not fully convinced yet. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapsh

Quote the bytes or sit down. Bookmarking this for the lab wiki. On «Lab notes: building a safe malware-analysis VM in 2026»: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Transfer samples as a hashed read-only ISO. Not drag-drop. Pinned a comment at 0x1400040c8 in the listing.

This belongs in the first-hour ritual. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Profile YARA. One looping regex will eat a core. I will +rep a listing and −rep a vibe. That is the deal.

Also: PE-sieve is a lead. It is not a verdict.

@shield

This belongs in the first-hour ritual. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only NIC, no shared fold

You are treating a checksum as a signature again. Agreed on the class, not on the tool. The load-bearing line: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I wrote a 12-line script and then threw it away. The listing was enough.

@softspoken

Agreed on the class, not on the tool. The load-bearing line: Host-only NIC, no shared folders, no drag-drop, snapshots before every detonati

I tried the naive path first and wasted a morning. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I will +rep a listing and −rep a vibe. That is the deal.

@svcusr

I tried the naive path first and wasted a morning. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only NIC, no

You skipped isolation and then asked why the box is dirty. That is on you. This is the kind of thread that should be a sticky and is not. «Lab notes: building a safe malware-analysis VM in 2026» — specifically Host-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging over serial or a. Profile YARA. One looping regex will eat a core. Did you snapshot before, or is this a restore-from-memory story? Same class as the January thread, different binary.