Malware Analysis Seminar (Summer 2012)

Classic tools

• Procmon (regmon, and friends are integrated now) http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Configure BIND to return one IP for all DNS queries

Taken from http://serverfault.com/questions/396958/configure-dns-server-to-return-same-ip-for-all-domains

With BIND, you need a fake root zone to do this. In named.conf, put the following:

zone "." {
    type master;
    file "/etc/bind/db.fakeroot";
};

Then, in that db.fakeroot file, you will need something like the following:

@ IN SOA ns.domain.com. hostmaster.domain.com. ( 1 3h 1h 1w 1d )
  IN NS <ip>
* IN A <ip>