I am starting off with malware reversing/analysis for the first time. I have been going through many resources on the internet. Some of them being pretty awesome and helpful, like SANS resources, Limon blog, Security trainings, reddit posts and many more. I am still in the process of setting up the environment required for getting started with my tryst with malware analysis (something that I have always been fascinated by).
However, there is one fundamental thing I am trying to understand. Please help me with the same :
The malware sample that I have is one that I collected from a live production environment (a Linux machine) that was compromised. Now I would like to first understand whether this malware was aimed at infecting Linux or Windows machines? In other words, is it a Linux or a Windows malware?
So right now I have started with the setup of the analysis environment as per the instructions here (Limon). I started with this because the malware was collected from a Linux box. So I am guessing it to be a Linux malware. Am I right in my thought process here. If not what should be the right approach?