Emulating a native USB stick within vmware











up vote
-1
down vote

favorite












I use a sandbox to test malware any analyse it.
One of the latest malware explicitly looks for USB-sticks to write code on it.
What I'd need is a little (windows) tool to emulate/fake a USB stick within the Win7 that acts like the malware victim, so the malware "thinks" it's real. That fake should not be recognised as fake to easy as the malware will not run then.
VMWare-tools usb-redirection is not an option as this implies VMWare tools installed and that is a nogo for the victim.



Thanks so much for your ideas... :-)



Cheers
Marcus






windows usb malware emulator







share|improve this question









New contributor




Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.




















  • Are you asking for a software recommendation?
    – dsstorefile1
    2 days ago










  • Actually, anything that would do the job. The only constraint is, that it looks as real USB stick as possible to the malware. ;-)
    – Marcus
    2 days ago










  • There are a couple SE questions about using dummy_hcd and g_mass_storage for emulating USB drives, but that idea doesn't work on Windows.
    – dsstorefile1
    2 days ago

















up vote
-1
down vote

favorite












I use a sandbox to test malware any analyse it.
One of the latest malware explicitly looks for USB-sticks to write code on it.
What I'd need is a little (windows) tool to emulate/fake a USB stick within the Win7 that acts like the malware victim, so the malware "thinks" it's real. That fake should not be recognised as fake to easy as the malware will not run then.
VMWare-tools usb-redirection is not an option as this implies VMWare tools installed and that is a nogo for the victim.



Thanks so much for your ideas... :-)



Cheers
Marcus






windows usb malware emulator







share|improve this question









New contributor




Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.




















  • Are you asking for a software recommendation?
    – dsstorefile1
    2 days ago










  • Actually, anything that would do the job. The only constraint is, that it looks as real USB stick as possible to the malware. ;-)
    – Marcus
    2 days ago










  • There are a couple SE questions about using dummy_hcd and g_mass_storage for emulating USB drives, but that idea doesn't work on Windows.
    – dsstorefile1
    2 days ago















up vote
-1
down vote

favorite









up vote
-1
down vote

favorite











I use a sandbox to test malware any analyse it.
One of the latest malware explicitly looks for USB-sticks to write code on it.
What I'd need is a little (windows) tool to emulate/fake a USB stick within the Win7 that acts like the malware victim, so the malware "thinks" it's real. That fake should not be recognised as fake to easy as the malware will not run then.
VMWare-tools usb-redirection is not an option as this implies VMWare tools installed and that is a nogo for the victim.



Thanks so much for your ideas... :-)



Cheers
Marcus






windows usb malware emulator







share|improve this question









New contributor




Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.











I use a sandbox to test malware any analyse it.
One of the latest malware explicitly looks for USB-sticks to write code on it.
What I'd need is a little (windows) tool to emulate/fake a USB stick within the Win7 that acts like the malware victim, so the malware "thinks" it's real. That fake should not be recognised as fake to easy as the malware will not run then.
VMWare-tools usb-redirection is not an option as this implies VMWare tools installed and that is a nogo for the victim.



Thanks so much for your ideas... :-)



Cheers
Marcus






windows usb malware emulator




windows usb malware emulator






share|improve this question









New contributor




Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.











share|improve this question









New contributor




Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









share|improve this question




share|improve this question








edited 2 days ago









Hennes

58.6k792141




58.6k792141






New contributor




Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









asked 2 days ago









Marcus

1




1




New contributor




Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.





New contributor





Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.






Marcus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.












  • Are you asking for a software recommendation?
    – dsstorefile1
    2 days ago










  • Actually, anything that would do the job. The only constraint is, that it looks as real USB stick as possible to the malware. ;-)
    – Marcus
    2 days ago










  • There are a couple SE questions about using dummy_hcd and g_mass_storage for emulating USB drives, but that idea doesn't work on Windows.
    – dsstorefile1
    2 days ago




















  • Are you asking for a software recommendation?
    – dsstorefile1
    2 days ago










  • Actually, anything that would do the job. The only constraint is, that it looks as real USB stick as possible to the malware. ;-)
    – Marcus
    2 days ago










  • There are a couple SE questions about using dummy_hcd and g_mass_storage for emulating USB drives, but that idea doesn't work on Windows.
    – dsstorefile1
    2 days ago


















Are you asking for a software recommendation?
– dsstorefile1
2 days ago




Are you asking for a software recommendation?
– dsstorefile1
2 days ago












Actually, anything that would do the job. The only constraint is, that it looks as real USB stick as possible to the malware. ;-)
– Marcus
2 days ago




Actually, anything that would do the job. The only constraint is, that it looks as real USB stick as possible to the malware. ;-)
– Marcus
2 days ago












There are a couple SE questions about using dummy_hcd and g_mass_storage for emulating USB drives, but that idea doesn't work on Windows.
– dsstorefile1
2 days ago






There are a couple SE questions about using dummy_hcd and g_mass_storage for emulating USB drives, but that idea doesn't work on Windows.
– dsstorefile1
2 days ago












1 Answer
1






active

oldest

votes

















up vote
0
down vote













Use ImDisk to create a virtual USB-drive to test your malware with.



Link to ImDisk Toolkit software: https://sourceforge.net/projects/imdisk-toolkit/



However I don't know if the malware will recognize this as fake or not.






share|improve this answer





















    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "3"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });






    Marcus is a new contributor. Be nice, and check out our Code of Conduct.










     

    draft saved


    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1376223%2femulating-a-native-usb-stick-within-vmware%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes








    up vote
    0
    down vote













    Use ImDisk to create a virtual USB-drive to test your malware with.



    Link to ImDisk Toolkit software: https://sourceforge.net/projects/imdisk-toolkit/



    However I don't know if the malware will recognize this as fake or not.






    share|improve this answer

























      up vote
      0
      down vote













      Use ImDisk to create a virtual USB-drive to test your malware with.



      Link to ImDisk Toolkit software: https://sourceforge.net/projects/imdisk-toolkit/



      However I don't know if the malware will recognize this as fake or not.






      share|improve this answer























        up vote
        0
        down vote










        up vote
        0
        down vote









        Use ImDisk to create a virtual USB-drive to test your malware with.



        Link to ImDisk Toolkit software: https://sourceforge.net/projects/imdisk-toolkit/



        However I don't know if the malware will recognize this as fake or not.






        share|improve this answer












        Use ImDisk to create a virtual USB-drive to test your malware with.



        Link to ImDisk Toolkit software: https://sourceforge.net/projects/imdisk-toolkit/



        However I don't know if the malware will recognize this as fake or not.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered 2 days ago









        Aulis Ronkainen

        5491412




        5491412






















            Marcus is a new contributor. Be nice, and check out our Code of Conduct.










             

            draft saved


            draft discarded


















            Marcus is a new contributor. Be nice, and check out our Code of Conduct.













            Marcus is a new contributor. Be nice, and check out our Code of Conduct.












            Marcus is a new contributor. Be nice, and check out our Code of Conduct.















             


            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1376223%2femulating-a-native-usb-stick-within-vmware%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            -

            Popular posts from this blog

            flock() on closed filehandle LOCK_FILE at /usr/bin/apt-mirror

            Image
            0 I recently upgraded an Ubuntu 16.04 virtual machine to 18.04. I regularly use this VM to run apt-mirror at school on their high-speed internet, then rsync these files to my rack-mount server at home for updating multiple computers at home without wasting the tiny amount of bandwidth I have there. Since updating I can't get apt-mirror to run on my VM. It keeps giving the error: flock() on closed filehandle LOCK_FILE at /usr/bin/apt-mirror line 214 immediately followed by: apt-mirror is already running, exiting at /usr/bin/apt-mirror line 217 apt-mirror is NOT running, and does not have a cron job. I've tried rebooting, and even looked for the old-style lockfile to delete, but I guess that method is no longer used. Is there some way to force unlock this so I can run apt-mirror? UPDATE: So... I f...
            Read more

            Mangá

            Image
              Nota:  Não confundir com Manga. Mangás e Animes Mangá Mangaká • Tankōbon Film comic La nouvelle manga Mangá original em inglês Anime História Animação influenciada por animes • Filler • OVA • Seiyū Públicos Kodomo • Shōjo • Shōnen Josei • Seinen Gêneros Mahō shōjo • Mecha • Harém Ecchi • Hentai ( Yaoi • Yuri Futanari • Shotacon • Lolicon Toddlercon ) Termos Bishōjo • Chibi • Fan service Gaiden • Kawaii • Kaitō • Light novel Mahō shōnen • Moe (antropomorfismo • Kemonomimi Nekomimi ) • Super deformed Omake • Tsundere • Yonkoma Listas Mangás • Animes • Ecchi • Mangaka • Estúdios • Revistas Fãs ( otaku ) Anime Music Video Convenções • Cosplay Dōjinshi • Fansub • Fandub • Fujoshi OS-tan • Scanlation Portal de Anime e mangá v d e O mangá (português brasileiro) ou manga (português europeu) [ 1 ] (em japonês: 漫画 , manga ? , lit. “história em quadrinhos”) , é a ...
            Read more

            Eduardo VII do Reino Unido

            Image
            Eduardo VII Rei do Reino Unido da Grã-Bretanha e Irlanda e dos Domínios Britânicos de Além-mar Imperador da Índia Rei do Reino Unido e Imperador da Índia Reinado 22 de janeiro de 1901 a 6 de maio de 1910 Coroação 9 de agosto de 1902 Delhi Durbar 1 de janeiro de 1903 Predecessora Vitória Sucessor Jorge V   Esposa Alexandra da Dinamarca Descendência Alberto Vitor, Duque de Clarence e Avondale Jorge V do Reino Unido Luísa, Princesa Real Vitória de Gales Maud de Gales Alexandre João de Gales Casa Saxe-Coburgo-Gota Nome completo Alberto Eduardo Nascimento 9 de novembro de 1841   Palácio de Buckingham, Londres, Reino Unido Morte 6 de maio de 1910 (68 anos)   Palácio de Buckingham, Londres, Reino Unido Enterro Capela de São Jorge, Windsor, Berkshire, Reino Unido 20 de maio de 1910 Pai Alberto de Saxe-Coburgo-Gota Mãe Vitória do Reino Unido Assinatura ...
            Read more