{"id":313,"date":"2021-12-05T19:27:05","date_gmt":"2021-12-05T18:27:05","guid":{"rendered":"https:\/\/counterintelligence.pl\/?page_id=313"},"modified":"2021-12-13T22:41:10","modified_gmt":"2021-12-13T21:41:10","slug":"rainevm-reversing-analysis-workstation","status":"publish","type":"page","link":"https:\/\/counterintelligence.pl\/en\/rainevm-reversing-analysis-workstation\/","title":{"rendered":"RaineVM - Reversing \/\/ Analysis workstation"},"content":{"rendered":"
\"\"<\/figure><\/div>\n\n\n\n

Download here!<\/a><\/p>\n\n\n\n

Login: Raine<\/p>\n\n\n\n

password: reversing<\/p>\n\n\n\n

RaineVM in a way complements Ronan<\/a> - it is an image of a virtual machine with installed tools for analyzing files, including malware. After we have obtained the samples in the course of our OSINT search, we can then transfer it to Raine and take a closer look. Why not just add these tools to RonanVM? In my opinion, analyzing files, especially potentially malicious ones, necessarily requires a separate environment. It's not even about the possibility of infecting our system - in the case of Linux it will be very limited - but about the system configuration that we will have to modify frequently - such as: adjusting network interface settings to disable or redirect traffic. And if we analyze a sample that may infect our system, we will very often restore the system to its initial state using snapshots.<\/p>\n\n\n\n

Raine just as Ronan have privacy oriented configuration - Ubuntu's telemetry is disabled as are features like file history, Firefox is also configured as in Ronan. As for the tools, the following are available:<\/p>\n\n\n\n