恶意程序隔离分析环境搭建

---
name: analysis-environment-setup
description: Configure isolated malware analysis environments including VM setup, tool installation, network isolation, and snapshot management for safe and reproducible analysis workflows.
---

# Analysis Environment Setup

Configure isolated analysis environments for safe malware analysis. This skill covers VM provisioning, tool installation, network isolation, and snapshot management.

## Prerequisites

- **Hypervisor**: VirtualBox, VMware, or Hyper-V for virtual machine management
- **Base OS images**: Ubuntu 22.04+ (for REMnux) or Windows 10/11 (for FLARE VM)
- **Minimum VM resources**: 4 GB RAM, 2 CPU cores, 60 GB disk
- **INetSim**: Simulated internet services for network isolation
- **iptables**: Linux firewall for network traffic control
- **Analysis tools**: capa, YARA, radare2 (installed via setup scripts)

## Steps

### 1. Select Analysis Platform

Determine the appropriate analysis platform based on the malware target:

- **Linux (REMnux)**: For analyzing Linux malware, documents, scripts, and network traffic. Use `scripts/setup_remnux.sh`.
- **Windows (FLARE VM)**: For analyzing Windows PE executables, Office documents, and .NET assemblies. Use `scripts/setup_flarevm.ps1`.
- Consult `references/tool-inventory.md` for the complete list of tools installed by each script.

### 2. Provision the Virtual Machine

1. Create a new VM in your hypervisor (VirtualBox, VMware, or Hyper-V).
2. Allocate at least 4 GB RAM, 2 CPU cores, and 60 GB disk.
3. Install the base operating system (Ubuntu 22.04+ for REMnux, Windows 10/11 for FLARE VM).
4. Install guest additions or VMware Tools for clipboard and display support.
5. Take an initial clean snapshot before any tool installation.

### 3. Install Analysis Tools

Run the appropriate setup script:

- **Linux**: `sudo bash scripts/setup_remnux.sh`
- **Windows**: Run PowerShell as Administrator, then: `.\scripts\setup_flarevm.ps1`

Both scripts install disassemblers, debuggers, network analysis tools, and Python libraries. See `references/environment-guide.md` for detailed configuration.

### 4. Configure Network Isolation

Before detonating any sample, isolate the VM network:

```bash
sudo bash scripts/network_isolation.sh --mode isolated
```

This script configures:
- iptables rules to block outbound traffic
- INetSim for simulated internet services
- DNS sinkhole to capture resolution attempts

To restore normal networking:

```bash
sudo bash scripts/network_isolation.sh --mode normal
```

See `references/environment-guide.md` for advanced network configurations (e.g., selective pass-through, traffic capture).

### 5. Take a Clean Snapshot

After tools are installed and the network is configured, take a snapshot labeled `analysis-ready`. Revert to this snapshot before each new analysis session.

### 6. Validate the Environment

Verify the installation:
- Run `capa --version`, `yara --version`, `r2 -v` to confirm tool availability.
- Test network isolation by attempting outbound connections (they should fail or be redirected to INetSim).
- Confirm snapshot revert works correctly.

## References

- `references/environment-guide.md` — Comprehensive environment setup guide
- `references/tool-inventory.md` — Complete analysis tool inventory with installation instructions