ransomware

How I Set Up My Malware Analysis Lab (And the Tools I Actually Use)

Yavuz Han Yavuz Han

I’d like to share some information about the lab environment I use for malware analysis and the tools that go along with it. I’ve tried many different setups over the years, but this one is the closest I’ve come to an ideal configuration.

I should also mention upfront: the tools I cover here are ones I’ve personally tried or currently use, so don’t expect usage guides — that’s not what this post is about.

  1. VMWare Fusion - https://www.vmware.com/

  2. VirtualBox - https://www.virtualbox.org/

My main machine is a MacBook Pro running High Sierra. For virtualization I decided to use both VMware Fusion and VirtualBox. You might wonder why two different products — the reason is disk space. VMware runs directly off the internal drive, while VirtualBox runs off an external hard drive. I created two virtual machines: Windows 7 x86 (on VMware) and Windows 7 x64 (on VirtualBox).

Debuggers

When I first started doing analysis, I used OllyDbg. Over time I moved to ImmunityDbg, which I still reach for often. Both OllyDbg and ImmunityDbg are x86-only, which was fine for a long time — but things change. x64dbg is a good example of that change: it supports both x86 and x64, and it’s what most analysts use today. I’m still getting comfortable with it myself.

There’s one more debugger that deserves its own mention: WinDbg. If your work involves the Windows kernel, WinDbg isn’t optional — it’s the tool. I’ll be honest, the UI has never been my favorite, but the moment I’m doing anything kernel-related, it’s my first choice.

  1. OllyDbg – http://www.ollydbg.de/

  2. ImmunityDbg – https://www.immunityinc.com/products/debugger/

  3. x64/32Dbg – https://x64dbg.com/

  4. WinDbg – https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools

Disassemblers

My primary disassembler is IDA Pro. There is one drawback worth mentioning though: if I recall correctly, the free version dropped x86 support around 2017, which was actually one of my reasons for setting up an x64 VM.

I’ve also been experimenting with Radare2, particularly its visual mode. My early attempts didn’t go very well, but I haven’t given up — I’m still learning it. It seems like a genuinely useful skill to have, and I may try to put together a tutorial on it at some point.

One more tool I came across is Hopper. I only installed it briefly to take a look, but the UI genuinely impressed me. It launched as a macOS-only tool, but the last time I checked, Linux versions were available as well.

  1. IDA Pro – https://www.hex-rays.com/products/ida/

  2. Radare2 – http://beta.rada.re/en/latest/

  3. Hopper – https://www.hopperapp.com/

Decompilers

I’ve mainly used decompilers for .NET and Visual Basic targets. The .NET side came with a catch though — DnSpy requires Visual Studio, which I can’t run in my current setup. I’ll sort that out once I have more disk space. For deobfuscation and unpacking I use de4dot, which has been solid.

  1. DnSpy – https://github.com/0xd4d/dnSpy/releases

  2. V8Decompiler – https://www.vb-decompiler.org/download.htm

  3. de4dot – https://github.com/0xd4d/de4dot

  4. .NET Reflector – https://www.red-gate.com/products/dotnet-development/reflector/

Other Tools

Everything above covers my core workflow. The tools below are ones I’ve used at various points, particularly on the x86 side — there’s a lot of useful tooling that’s still x86-only.

  1. PE-bear — Written by a Polish cybersecurity researcher whose work I genuinely enjoy following. PE-bear is a freeware reversing tool for PE files, built to give analysts a fast and flexible first look at a sample — including malformed PEs. Supports both x86 and x64.

  2. Process Explorer — A free task manager and system monitor from Sysinternals. Especially useful for watching how malware moves and distributes itself while it’s running. Supports x86 and x64.

  3. HxD — A widely used hex editor with a clean, straightforward interface.

  4. XVI32 — My personal favorite hex editor, though it’s x86-only.

  5. PE Studio — Particularly useful for getting a structural overview of a suspicious file before executing it.

  6. PEiD — Detects common packers, cryptors, and compilers for PE files. No longer actively developed, but still findable and still useful.

That covers my current setup. As I said at the start, this is just a list of what I use — not a how-to guide. That said, if you’re looking for resources on any of these tools, feel free to reach out.