So.. can i run RATS like agenttesla in this?

the file is no longer availble on the site please do an update

yeah that's something I'm also wondering

Have you done this test yet? Curious if the encryption never starts or if the ransomware just encrypts with any random key? It's not like they care about person's data. They might just end all forms of communication to the victim once the payment is made

@@ShantanuBaviskar please watch the video of computerphile about wannacry (he has two vids) in one of them he explains this quite well.

@@ShantanuBaviskar I experienced this once with a client whose office was infected by ransomware. The virus made its way onto the entire network via an infected USB stick from an employee. First thing the virus did was to contact the hacker's server to request a key which it then used to encrypt all the files on the server. It even encrypted the backup files (this was just before the advent of cloud backup). The ONLY WAY to retrieve the data was to pay off the hackers, they wanted something like 2,000 Euros but I negotiated them down to about 700. They were surprisingly polite and accommodating, but then again this was when ransomware first became a thing a couple of years ago. The minute we paid them in bitcoins, they emailed us the decryption key. After entering the key in the ransomware exe, it immediately decrypted all our files. As I understand it though, if the ransomware exe can't reach its home server for an encryption key, then it simply ends itself because it can't encrypt your files without a key. That's why the first thing to do if you think you've been infected by ransomware is to IMMEDIATELY disconnect the internet connection.

@@CurtisCT well i do think it depends on the type of malware used... leetcipher has a pretty good tutorial on how malware is written, check him out.

ctrl+o to save. then ctrl+x to exit out of nano editor

Install VPN on host system? Should be okay?

Good question, I agree that connections with your host machine whether direct or indirect can be scary. What I would recommend is to create a snapshot (backup image) of the vm state where there is internet access - (during this point you should also download the samples on the vm) and then another snapshot directly afterwards, with no internet access. So essentially, whenever you need to download a new sample, you can revert back to an older snapshot instantly where your vm has internet access, and then you can download a new sample, disable internet, and run the malware.

@@xrootkits Thanks, you could also clarify for others that most malware samples are compressed and password protected so there usually isn't a direct threat until you extract the sample from archive. Even then, the files in the archive have their file extension removed or changed to something so the .exe is not activated upon opening it.

@@BorisJohnsonMayor You're welcome, and yeah that is completely true, I actually made a video on theZoo a while back on my tiktok, one of my first videos actually

@@xrootkits If I have windows with admin rights separated from standard user, virus would need my password anyway to make changes right?

Hannah Montana Distro !

I use a local web server, but you can also create a shared folder in vbox, or enable drag and drop, there are many different ways

Apparently not. Apparently not. Apparently not.Apparently not.Apparently not. 😊

If you turn on your WiFi I think

It can't do it if it's turned off

You wouldn't need a lot, you can create a good lab with >8 gigs, but even with 4 you can still create a malware lab

I have 16 GB and have no problems

8 GB here, I have no idea why GDI malware is so fast on Windows 7

Yeah, it's an awesome distro imo, love it

@@xrootkits nice i will try arch linux someday

It sucks ​@@xrootkits