INetSim: The Fake Internet Every Malware Analyst Needs

Hey Malware Analyst

Today, we’re diving into a fascinating tool that quietly powers many malware analysis labs around the world: INetSim.

If you’re new to it, INetSim stands for Internet Services Simulation Suite — a lightweight, open-source framework designed to simulate common internet services in a fully controlled environment. In short, it gives analysts a safe “fake internet” so malware can behave as if it’s online, without ever touching the real one.

In this article, we’ll walk through how to set up and use INetSim within a REMNUX environment.

One of the advantages of using REMNUX is that INetSim comes pre-installed . REMNUX already enables many of INetSim’s core services by default, making it easy to start analyzing malware traffic right away.

However, to ensure everything works smoothly in a controlled lab environment, we’ll make a few important adjustments. Specifically, we’ll:

• Enable the DNS service
• Change the bind IP address
• Set the default DNS IP

These changes help INetSim correctly handle requests coming from your malware analysis VM.

All configuration settings for INetSim are stored in:

/etc/inetsim/inetsim.conf

We’ll be editing this file to tune the behavior of the fake internet to our needs.

Inside the inetsim.conf file, a few key settings are commented out by default. To make INetSim fully functional in our REMNUX setup, we’ll update three important lines.

Enable the DNS Service

In the config file, you’ll find:

#start_service dns

The # disables the line, so INetSim won’t start the DNS service unless we remove it.

Go ahead and uncomment it:

start_service dns

This ensures INetSim responds to all DNS queries coming from your malware analysis VM.

Change the Bind Address

Next, look for:

#service_bind_address   10.10.10.1

Uncomment it and change the IP to:

service_bind_address   0.0.0.0

It tells INetSim to listen on all available network interfaces, not just a single IP.

Set the Default DNS Response IP

Finally, update:

#dns_default_ip         10.10.10.1

Uncomment it and replace the IP with your REMNUX machine’s actual IP address on the analysis network:

dns_default_ip         <your-remnux-ip>

This tells INetSim to redirect every DNS lookup from the malware to your REMNUX box, ensuring all traffic stays inside your isolated lab and gets logged.

After saving the changes, simply run inetsim from the terminal. It will start with the updated settings, enable the DNS service, and your setup will be ready to use.

I hope you enjoyed this article, will be back with another new article soon. Happy Hacking 🤟