How do I activate a malware inside a virtual machine?

Question

I have been doing research on malware detection and my current setup is: one host OS (Ubuntu 18.04) and one guest OS (Ubuntu 18.04) inside VirtualBox. I have downloaded and executed some malware (including Linux, Windows and OS X platform malware) to the guest OS. But I can not visually see the effects of the malware, not even in case of the Linux targeted ones which would have proven that the malware are active/malicious. The VirtualBox log files (which are my point of interest) have not given me any insight on this issue.

Should I use any tool to activate malware and if so, would you please suggest me some tools?

N.B: I collected most of the malware from "The Zoo" repository on GitHub and the rest from other resources.

Answer 1

It really sounds like what you want to use is a malware analysis sandbox. These are pre-made and hardened virtual machines designed to detonate and observe the effects of malware. These sandboxes also come in different OS flavours.

A malware analysis sandbox extracts network activity, internal process hooking, disk activity, browser activity, etc. From the analysis tools, it becomes simple to create IoCs and signatures for use in other tools, like IPS/IDS or endpoint protection.

Cuckoo is a popular option and is open-source. There is a free online version to use if you want to use it without needing to set it up yourself.

There are many others like Joe Sandbox, Any.run, and FLARE.

The downside to some automated malware sandboxes is that you don't have a lot of power to change the environment or get your hands on the guts of the malware code, although some have debuggers built-in so that you can.

But from the type of questions you are asking, it looks like you should start with an automated sandbox and grow from there.

Answer 2

You need to read Shitorski's Practical Malware Analysis. It'll answer all these questions, and it'll give you the tools needed to investigate. Get a NUC.

1. You need a tools like RegistryChangesView, TCPLogView, Process Explorer. The Vbox logs are basically going to tell you about your Virtual Box platform, and won't give details about malware detonation.
2. Windows exe files cannot affect Linux because it doesn't have the code to process malware commands. Like, there's no C:\Temp, managing the hardware is different. OSX malware potentially could affect Linux because they're related to Unix. They don't stay dormat, they're useless programs. Btw, malware can scan an virtual machine and become dormat to hide from analysis, or can even break out of the environment.