FakeNet – Beta – Windows Network Simulation tool for Malware Analysis.

FakeNet is Windows network simulation tool designed for malware analysis. It redirects all traffic leaving a machine to the localhost (including hard-coded IP traffic and DNS traffic) and implements several protocols to ensure that malicious code continues to execute and can be observed by a malware analyst.

The tool supports DNS, HTTP, and SSL protocols and provides a python extension interface for implementing new or custom protocols. It also the capability to listen for traffic to any port as well as create packet capture on the localhost.

Right now the tool only support WinXP Service Pack 3. The tool runs fine on Windows Vista/7 although certain features will be automatically disabled.

Features

  • Supports DNS, HTTP, and SSL
  • HTTP server always serves a file and tries to serve a meaningful file; if the malware request a .jpg then a properly formatted .jpg is served, etc. The files being served are user configurable.
  • Ability to redirect all traffic to the localhost, including traffic destined for a hard-coded IP address.
  • Python extensions, including a sample extension that implements SMTP and SMTP over SSL.
  • Built in ability to create a capture file (.pcap) for packets on localhost.
  • Dummy listener that will listen and display traffic destined for any port.

Platform : Windows

Download Latest Version : FakeNet0.9.exe (8.3 MB)

Find Other Version |

Read more in here : http://practicalmalwareanalysis.com/

Advertisements