SAFETY: You Are Running Live Malware

Rule Zero

Assume the sample is hostile and will try to spread, persist, phone home,

or destroy data. Contain it before you run it.

• Isolated network: host-only or internal VM network. Never bridge to your real LAN or the internet.
• Snapshots: take a clean snapshot before detonation; revert after every single run.
• No shared folders, no shared clipboard — both are escape and infection paths.
• Fake internet: simulate services so the malware "believes" it is online (see FakeNet-NG / INetSim).
• Treat VM escape as possible: patch your hypervisor, do not store real credentials in the analysis host.