## Setting Up a Safe Malware Lab

**WARNING**: NEVER analyze malware on your host machine or your corporate workstation. One mistake and you infect the network. You need a dedicated, isolated lab.

### 1. The Hypervisor
You need virtualization software.
*   **VirtualBox** (Free, Open Source).
*   **VMware Workstation** (Standard, robust).

### 2. The Network Isolation (Crucial!)
You must ensure the malware cannot talk to your home/work network.
*   **Host-Only Mode**: The VM can talk to the Host (and other VMs) but **cannot** access the Internet or your LAN.
*   **Custom vNet**: Create a completely isolated virtual switch.
*   **Fake Internet**: Use a tool like **INetSim**.
    *   Malware: "I want to download bad.exe from evil.com"
    *   INetSim: "I am evil.com! Here is your file." (Sends a harmless dummy file).
    *   *Result*: The malware runs, thinking it has internet, but is safely contained.

### 3. The Analysis VMs
You don't just need a Windows 10 ISO. You need tools.
*   **FlareVM (Windows)**: A script by Mandiant. You install a clean Windows VM, run the script, and it installs hundreds of tools (x64dbg, PEStudio, Wireshark, Process Hacker).
*   **REMnux (Linux)**: A Linux distro built for malware analysis (like Kali, but for reverse engineering). It includes tools to analyze PDF/Office docs, decode scripts, and run INetSim.

### 4. Snapshotting
This is the superpower of VMs.
1.  Install Windows.
2.  Install Tools.
3.  Disable Windows Defender (so it doesn't delete your samples).
4.  **TAKE A SNAPSHOT** (Name it: "Clean State").
5.  Infect the VM. Watch it die.
6.  **Revert to Snapshot**.
7.  In 10 seconds, you are back to a clean state, ready for the next sample.

### Lab Safety Rules
1.  **Disconnect**: Verify network adapter is "Host-Only" or "Custom".
2.  **No Sharing**: Disable "Shared Folders" between Host and Guest.
3.  **No USB**: Do not plug USB drives into the VM.
4.  **VPN**: If you must analyze "live" (letting it connect to internet), use a VPN and a "Burner" network separate from your company Wi-Fi.