Hacker News Reader

Comment by thomasdub | Hacker News Reader

This is quite dangerous unless you know what you’re doing, if you execute the malware then plan to throw away all equipment you’re using to analyze it. For a next-best experience, if you’re curious, you should upload one to an online malware sandbox e.g. app.any.run which allows you interact with it, look at network traffic, inspect file mods etc. - all the fun, much much less risk and hassle!

View on HN

Be careful if you're trusting any of those sandbox services for accurate results though - some malware is able to detect the VM they're running in and refuse to run the malicious payload. Often times legitimate cracks will be distributed on sources like Usenet using a "binder" to attach the malicious payload the an otherwise perfectly fine crack.

As a side note, for some reason, there's way more malware on usenet than bittorrent, I've even found it on games on major NZB sites, possibly just due to the seed counts weeding out the malicious ones via simple popularity in the public bittorrent world.

> if you execute the malware then plan to throw away all equipment you’re using to analyze it

I'm not sure your run of the mill malware is doing anything that can't be fixed by a format and reinstall, but yes, use an isolated VM.

Cuckoo Sandbox is a decent self hosted tool for analysing malware. Though a complete pain to setup. Even with some of the scripts making parts of it easier.

Reply on news.ycombinator.com