Setting up INetSim on Remnux

You can grab the remnux ova from here >>> https://docs.remnux.org/install-distro/get-virtual-appliance

Remnux is Linux based (assuming that the malware to be detonated is a PE) and will act as an Internet Simulator. It also acts as a network analysis platform and generates network based indicators when detonating our malware.

Inetsim

Lets edit the inetsim’s configuration file

sudo nano /etc/inetsim/inetsim.conf

We want to enable DNS so uncomment start_service dns.

Uncomment service_bind_Address and change it to 0.0.0.0

Scroll down to the DNS Service section and change the dns_default_ip to the ip address of your Remnux. This is because we want Remnux to be the DNS server.

Lets run inetsim and your output should be similar to the image below!

Now go over to your Flare-VM, open up a web browser and try to navigate to your Remnux IP address. If everything is set up properly, you should see the following page served

To resolve the domain names, go to network connections on your Flare-VM and point the DNS server towards your Remnux as the settings below:

Hence you can now key in any domain on the web browser and Remnux acting as the DNS server will resolve the domain. You should see something like this:

You are all set up:)