Password managers, shopping, anything that talks. The tools VM is not your laptop. If you need a password, use the password box, not the browser.
Extensions are other people's code. Other people's code does not live next to samples.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the writeup I wanted when I was stuck. The load-bearing line: Password managers, shopping, anything that talks. Dirty VM means throw it. Do not apt upgrade a dirty box. I wrote a 12-line script and then threw it away. The listing was enough.
@foren
This is the writeup I wanted when I was stuck. The load-bearing line: Password managers, shopping, anything that talks. Dirty VM means throw
I want the listing, not the decompiler story. «A list of browser extensions I ban from the tools VM» — specifically Password managers, shopping, anything that talks. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Same class as the March thread, different binary.
@gate
I want the listing, not the decompiler story. «A list of browser extensions I ban from the tools VM» — specifically Password managers, shopp
You skipped isolation and then asked why the box is dirty. That is on you. Good. Dated shot, version in the post. On «A list of browser extensions I ban from the tools VM»: Password managers, shopping, anything that talks. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Took me 11 hours the first time.
Not fully convinced yet. You wrote «Password managers, shopping, anything that talks». That is the sentence I keep. Profile YARA. One looping regex will eat a core. After you did that, did the decompiler pick it up or did you dump? Took me 9 hours the first time.
@hexor
Not fully convinced yet. You wrote «Password managers, shopping, anything that talks». That is the sentence I keep. Profile YARA. One loopin
This is the writeup I wanted when I was stuck. The load-bearing line: Password managers, shopping, anything that talks. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I reproduced it on lab build 1274.