Containers share a kernel. Samples that talk to kernels are why we have VMs. Docker is for our tools, not for their samples.
If you detonate in Docker I will not help you clean the host.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
Quietly the best note on this board this month. The load-bearing line: Containers share a kernel. Dirty VM means throw it. Do not apt upgrade a dirty box. If anyone DMs me a zip I will not open it. Hash in-thread.
@secmod
Quietly the best note on this board this month. The load-bearing line: Containers share a kernel. Dirty VM means throw it. Do not apt upgrad
Good. Dated shot, version in the post. «Docker as a malware lab — I still say no» — specifically Containers share a kernel. FakeNet that can reach the internet is not a simulator. My note id for this: 110-01.
@sn0op
Good. Dated shot, version in the post. «Docker as a malware lab — I still say no» — specifically Containers share a kernel. FakeNet that can
Take the telegram pitch to the bin. Market listing or nothing. I still keep a paper notebook for this kind of note. «Docker as a malware lab — I still say no» — specifically Containers share a kernel. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Same class as the January thread, different binary.
This is the kind of thread that should be a sticky and is not. «Docker as a malware lab — I still say no» — specifically Containers share a kernel. Profile YARA. One looping regex will eat a core. Did you snapshot before, or is this a restore-from-memory story? I wrote a 12-line script and then threw it away. The listing was enough.
@threxz
This is the kind of thread that should be a sticky and is not. «Docker as a malware lab — I still say no» — specifically Containers share a
I tried the naive path first and wasted a morning. «Docker as a malware lab — I still say no» — specifically Containers share a kernel. Clipboard off on the detonation VM. I pasted a token once. Version in my shot: current lab snapshot, not last year's blog.
I will argue the opposite and then probably agree. On «Docker as a malware lab — I still say no»: Containers share a kernel. Clipboard off on the detonation VM. I pasted a token once. I reproduced it on lab build 1132.