tools

Overview

INetSim (Internet Services Simulation Suite) is a tool used for dynamic malware analysis. It creates a fake network environment that simulates internet services, allowing you to observe how malicious software behaves — what it connects to, what it downloads, and how it communicates — without exposing a real network.

Target / Context

Malware analysis lab environments. Run on a dedicated analysis VM to intercept and simulate outbound malware connections. Pairs with packet capture tools for full behavioral analysis.

Installation

ℹ︎Installation Commands: 
sudo apt install inetsim

Basic Usage

ℹ︎Basic Usage: 
sudo inetsim

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
Config fileMain configuration file/etc/inetsim/inetsim.conf
dns_default_ipDNS responses resolve to this IPSet to your analysis machine IP

Common Use Cases

Configure and Start INetSim

ℹ︎Commands: 
sudo nano /etc/inetsim/inetsim.conf

Uncomment dns_default_ip and set it to your machine’s IP address.

sudo inetsim

Mimic Malware Downloading a Secondary Payload

Simulates how malware reaches out to external servers to download additional binaries or scripts.

ℹ︎Commands: 
sudo wget https://<INetSim IP>/second_payload.zip --no-check-certificate

Note: All files returned by INetSim are fake — safe to download in the analysis environment.

Read Connection Report

After analysis, review what connections the malware attempted.

ℹ︎Commands: 
cat /var/log/inetsim/report/<report file>
ls /var/log/inetsim/report/

References / Images