I want to know if I can open a virtual machine (VMware , Virtual Box ...) and (for example) install windows 7 + some programs (chrome,Word,antivirus....) and then save the current stat (i don't have any idea how i can) then execute a malware after that i want to know if it's possible to know the modified files and the new registry keys that they've added to the VM (All the modifications) after the first saved stat (just for malware analysis) and then i want to be able to return the VM to the first stat (in some tutorials on youtube i saw them saving the new modification in files like "Virus.VMEM" )

How can i do that on linux (Debian) I've already installed VMware and I'm ready to install any other tool could help me ?

I know it's difficult but please help with any idea :)

  • On Windows, I'd suggest running Attack Surface Analyzer before and after the malware (though a rootkit would attempt to hide from ASA, of course). I don't know of a Linux equivalent, though. – CBHacking Sep 13 '15 at 12:32
  • To see registry changes, there's an answer already superuser.com/questions/79566/… – Alfabravo Sep 15 '15 at 15:46

With Virtualbox (or VMware, it should be similar), you should be able to use "Snapshots" to rollback to a previous state.

The VM has to be powered off to be able to "Snapshot" the VM state. You can have multiple snapshots.

I'd recommended turning off the network card in Vbox/VMware before fiddling with the malware.

As to "how" to locate the changes the malwares as done, I do not know that part.

  • Welcome to SU, sadly in your Answer you only dont know the OP question. – Francisco Tapia Sep 15 '15 at 15:04
  • 1
    It perfectly answers 1 of his 2 questions. And sadly, I cannot comment. What should I have done ? – Eihwaz Sep 15 '15 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.