2026 Lab work
This is part of multiple install guides that I have made as I built out a new personal lab environment.
The following diagram shows a high-level view of the pipeline being built out.
Click to expand diagram
MALWARE ANALYSIS LAB
=======================================================================================
MALWARE INTAKE
│
┌──────────────────┼──────────────────┐
│ │ │
Sample Hash API
│ │ │
└──────────────────┴──────────────────┘
│
▼
┌───────────────────────────────────────────────────────────────┐
│ ASSEMBLYLINE4 │
│ Intake / Triage / Orchestration │
│ │
│ ┌───────────┐ ┌────────────┐ ┌───────────────────┐ │
│ │ File Type │ -> │ Static │ -> │ YARA / PE / Other │ │
│ │ / Hashing │ │ Analysis │ │ Analysis Services │ │
│ └───────────┘ └────────────┘ └─────────┬─────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────┐ │
│ │ CAPE Service│ │
│ └──────┬──────┘ │
│ │ │
└────────────────────────────────────────────────┼──────────────┘
│
Submit Sample
│
▼
┌───────────────────────────────────────────────────────────────┐
│ CAPEv2 │
│ Automated Dynamic Analysis │
│ │
│ API / Scheduler │
│ │ │
│ ▼ │
│ Machine Selection │
│ │ │
│ ▼ │
│ ┌──────────────────────────────┐ │
│ │ Windows Sandbox VM │ │
│ │ │ │
│ │ CAPE Agent │ │
│ │ │ │ │
│ │ ▼ │ │
│ │ Malware Execution │ │
│ │ │ │ │
│ │ ├── Process Behavior │ │
│ │ ├── API Activity │ │
│ │ ├── Memory │ │
│ │ ├── Dropped Files │ │
│ │ ├── CAPEMON │ │
│ │ └── Network Traffic ───────────────┐ │
│ └──────────────────────────────┘ │ │
│ │ │
│ CAPE Parsers │ │
│ Config Extraction │ │
│ PCAP │ │
│ Behavioral Report │ │
│ │ │ │
└─────────────────┼────────────────────────────┼────────────────┘
│ │
│ ▼
│ ┌──────────────────────────────┐
│ │ INetSim │
│ │ Simulated Malware Network │
│ │ │
│ │ DNS │
│ │ HTTP / HTTPS │
│ │ FTP / SMTP │
│ │ Other Fake Services │
│ │ │
│ │ "Controlled Fake Internet" │
│ └──────────────────────────────┘
│
▼
┌───────────────────────────────────────────────────────────────┐
│ CAPE RESULTS │
│ │
│ Behavior │ PCAP │ Extracted Files │ Config │ IOCs │ Dumps │
└──────────────────────────────┬────────────────────────────────┘
│
│
┌───────────────────┴─────────────────────┐
│ │
▼ ▼
Return Results to AL4 Escalate for Manual Analysis
│ │
▼ ▼
┌───────────────────────┐ ┌────────────────────────────────┐
│ ASSEMBLYLINE4 │ │ FLAREVM │
│ │ │ Manual Analysis / Reverse Eng. │
│ Aggregate Results │ │ │
│ Scoring │ │ Static Analysis │
│ Service Results │ │ │ │
│ Search / Hunting │ │ ├── IDA Pro │
│ │ │ ├── FLOSS │
└───────────┬───────────┘ │ ├── capa │
│ │ └── YARA │
│ │ │
│ │ Dynamic / Debug Analysis │
│ │ │ │
│ │ ├── x64dbg │
│ │ ├── API tracing │
│ │ └── Manual execution │
│ │ │
│ │ Reverse Engineering │
│ │ │ │
│ │ ├── Config extraction │
│ │ ├── C2 protocol │
│ │ ├── Crypto │
│ │ └── Capability analysis │
│ │ │
│ └───────────────┬────────────────┘
│ │
└───────────────────┬──────────────────┘
│
▼
┌─────────────────────────────────────┐
│ MALWARE INTELLIGENCE │
│ │
│ Malware Family │
│ Behavior / Capabilities │
│ Configuration │
│ C2 Infrastructure │
│ IOCs │
│ Detection Opportunities │
│ YARA / Signatures │
│ Reverse Engineering Findings │
└──────────────────┬──────────────────┘
│
▼
┌─────────────────────┐
│ REPORTING │
│ │
│ Malware Report │
│ Family Profile │
│ Threat Intel │
│ Detection Content │
└─────────────────────┘
Summary
This guide walks through installing InetSim onto an Ubuntu 26.04 LTS VM.
Download Ubuntu
Download, Install, and patch Ubuntu 26.04 LTS from the Canonical site.
Setup network
Create a new vmnet2 with the following configuration.
Figure 1: VMware vmnet setup
Add a new NIC to the InetSim VM as shown below.
Figure 2: VMware new network adapter settings
The following config file should be updated to the following.
1
2
3
4
5
6
7
8
9
10
11
sudo cat /etc/netplan/01-network-manager-all.yaml
# Let NetworkManager manage all devices on this system
network:
version: 2
renderer: NetworkManager
ethernets:
ens37:
dhcp4: false
dhcp6: false
addresses:
- 10.10.10.2/24
Run the following commands
1
2
sudo netplan generate
sudo netplan apply
Install InetSim
Run the following commands
1
2
3
4
5
6
7
sudo apt update
sudo apt install inetsim
inetsim --version
systemctl status inetsim --no-pager
ls -la /etc/inetsim/
grep -vE '^\s*(#|$)' /etc/inetsim/inetsim.conf
Configure INetSim deliberately for this topology
Back up the original configuration and then edit original
1
2
sudo cp /etc/inetsim/inetsim.conf /etc/inetsim/inetsim.conf.orig
sudo vim /etc/inetsim/inetsim.conf
Find these settings and configure them as follows. If they’re commented out, uncomment them
1
2
service_bind_address 10.10.10.2
dns_default_ip 10.10.10.2
Run the following commands to ensure inetsim is using the new configuration
1
2
sudo systemctl restart inetsim
sudo systemctl status inetsim --no-pager -l
Fix DNS compatibility issue
There is an issue is that INetSim 1.3.2 was written around an older Net::DNS API. Upstream INetSim still uses the historical main_loop, while modern Net::DNS has moved to start_server().
The reliable fix is to install an older compatible Net::DNS version specifically for INetSim, rather than trying to adapt ten-year-old INetSim internals to a 2026 Perl module API.
Install cpanm
1
sudo apt install cpanminus
You dont want to overwrite Ubuntu’s system Net::DNS 1.54 globally. Instead, install a private Perl library for INetSim:
1
2
3
4
sudo mkdir -p /opt/inetsim-perl
sudo cpanm --local-lib=/opt/inetsim-perl \
https://cpan.metacpan.org/authors/id/N/NL/NLNETLABS/Net-DNS-1.37.tar.gz
Update DNS.pm
1
2
3
4
5
6
7
8
9
10
11
sudo cp /usr/share/perl5/INetSim/DNS.pm /usr/share/perl5/INetSim/DNS.pm.bak
sudo vim /usr/share/perl5/INetSim/DNS.pm
# Near the top of the file, after the `package` declaration and before `use Net::DNS...`, add:
use lib '/opt/inetsim-perl/lib/perl5';
# Further down the file replace
$server->start_server(0);
# With
$server->main_loop;
Restart inetsim
1
2
sudo systemctl daemon-reload
sudo systemctl restart inetsim