How to install the malware for the lab environment

To add some interesting suspicious traffic, I have adopted a piece of malware that came as part of the book Practical Malware Analysis (https://nostarch.com/malware) called iprip.dll. It will register itself as a service on the system it ran on and continuously try to reach out to the website http://very-malicious-website.com. This behavior shows up in your logs as beaconing and command and control communications traffic.

To install the malware, download it from https://github.com/SackOfHacks/Industrial-Cybersecurity-2nd-Edition/blob/main/lab-setup/malware/IPRIPa.zip and unzip it (the archive password is infected).

On the system where you want to deploy the malware, open an elevated (administrator) Command Prompt and run the rundll32.exe IPRIPa.dll,install command:

Figure 19.16 – Installing the IPRIPa.dll malware

This installs the malware as a service. You can start the service with the net...