Analysing malware without a lab is how people infect their own machines. A lab is not optional infrastructure — it is the thing that makes the rest of the work safe.
Why a virtual machine, always
Run every sample inside a virtual machine, never on your host. A VM gives you two properties you cannot get otherwise:
- Isolation — the sample interacts with a synthetic operating system, not your real one.
- Reversibility — a snapshot lets you return to a clean state in seconds.
Both matter. Isolation alone is not enough, because a machine you cannot reset becomes progressively less trustworthy with every sample you detonate on it.
Picking a hypervisor
| Hypervisor | Host | Notes |
|---|---|---|
| VirtualBox | Windows, Linux, macOS (Intel) | Free, good snapshot UX, fine for static and light dynamic work |
| VMware Workstation / Fusion | Windows, Linux, macOS | Better performance and device emulation |
| KVM / QEMU | Linux | Scriptable, excellent for automation |
Any of them works. Pick the one you will actually maintain.
Networking: start with none
The default network posture for an analysis VM is no network at all. Bring connectivity up only when the analysis requires it, and even then prefer:
- Host-only networking — the VM can talk to a simulated service you control, nothing else.
- A fake internet — tools like FakeNet-NG or INetSim answer DNS and HTTP so the sample believes it reached its C2, while nothing leaves your machine.
Never bridge an analysis VM onto your home or corporate network.
Snapshot discipline
Take a snapshot of the clean VM before you copy a sample in, and revert after you finish. The discipline matters more than the tooling:
clean snapshot → copy sample in → analyse → revert to clean snapshot
If you skip the revert, you no longer know what is on the machine, and every later finding becomes questionable.
Moving samples safely
Transfer samples as password-protected archives (the convention is the password infected).
The password stops your host antivirus from helpfully "cleaning" the file mid-transfer, and it
stops accidental double-clicks. Extract the archive inside the VM, never on the host.
Day-one toolkit
For static triage: a hex editor, strings, a PE viewer, and CyberChef.
For dynamic work: Procmon, Process Explorer, Wireshark, and a fake-internet tool.
For reversing: Ghidra, which is free and genuinely capable.
The rule that matters most
Nothing you analyse should ever run on the machine you read email on. Everything else in this article is an implementation detail of that one rule.