[Kyaa]

Assuming that launching it in a VM is a must.
If it needs internet connection, I should probably start it with a VPN too. Any better solutions?

[Bish0pQ]

Just to note, not even in a VM you're entirely safe. Recently an article showed up (can not seem to find it now) about a RAT that could break out of the VM. It was pretty smart, since it would check system temperatures in order to know whether it was running in a VM or not.

I'd recommend a few things, even better than a VM would be just a very cheap testing system. It wouldn't even have to be that good, as long as you can run Win7 or Win10 you should be fine. 8GB of DDR2 costs also nothing more today.

Then I'd also recommend you run your program you would to analyze/use in a sandbox (like sandboxie). If it requires an internet connection, just use a VPN, and setup your firewall properly. Don't allow ports unless you want them to be open.

You could also debug it line per line and check whether there is malicious code, but I'm not sure if there would be a payload executed or anything when you try that.

[mothered]

It's good practice to have a dedicated system segregated from the network (If any), solely for testing purposes and nothing else.

A VM can also run on the physical machine. In the event malicious content bypasses the VM onto the host system, other than an hour or so formatting, you have nothing to lose. You can also lock down your system with Deep Freeze, meaning upon rebooting, It'll go back to It's previous state (at the time Deep Freeze was applied).

[Kyaa]

Just to note, not even in a VM you're entirely safe. Recently an article showed up (can not seem to find it now) about a RAT that could break out of the VM. It was pretty smart, since it would check system temperatures in order to know whether it was running in a VM or not.

I'd recommend a few things, even better than a VM would be just a very cheap testing system. It wouldn't even have to be that good, as long as you can run Win7 or Win10 you should be fine. 8GB of DDR2 costs also nothing more today.

Then I'd also recommend you run your program you would to analyze/use in a sandbox (like sandboxie). If it requires an internet connection, just use a VPN, and setup your firewall properly. Don't allow ports unless you want them to be open.

You could also debug it line per line and check whether there is malicious code, but I'm not sure if there would be a payload executed or anything when you try that.

It's good practice to have a dedicated system segregated from the network (If any), solely for testing purposes and nothing else.

A VM can also run on the physical machine. In the event malicious content bypasses the VM onto the host system, other than an hour or so formatting, you have nothing to lose. You can also lock down your system with Deep Freeze, meaning upon rebooting, It'll go back to It's previous state (at the time Deep Freeze was applied).

Thank you for your replies.

[mothered]

Please advise If you require assistance with the setup and configuration (etc) pertaining to any of the aforementioned details.

[reGEN]

Recently an article showed up (can not seem to find it now) about a RAT that could break out of the VM. It was pretty smart, since it would check system temperatures in order to know whether it was running in a VM or not.

If you're talking about GravityRAT, I don't think it had VM escaping capabilities. VM detection isn't anything new but the temperature trick was pretty neat.