Handling samples on the host

What Antinomie does

Samples run only in the guest. A sample is uploaded into the VM and run there. Upload file and the Upload source of Run program never run the file, and a launch happens only when you press Run.
Samples stay encrypted on the host. In 0.7.1, samples from Tools → Malware samples… stay in their encrypted archives in the data folder. In 0.8.0 New in 0.8.0 every sample, downloaded, added with Add file… or uploaded into a VM (up to 256 MiB), is kept in the sample library as an owner-only AES zip with the password infected. Archives are decrypted only in memory to be sent into the guest; nothing is unpacked or run on the host. The first time you open the malware download window it shows a warning about handling live malware (NAT, VM escape, antivirus, the law) that you must accept.
A sample is checked each time it is sent New in 0.8.0. Its archive is read back and its SHA-256 compared before it goes into a VM; a mismatch is refused. Add file… hashes the file without running or unpacking it, and deletes the original only if you ask and only after the archive was read back and matched.
Analysis runs in a sandbox. Static analysis, properties and detection scans run in a bubblewrap sandbox with the file read-only and no network. Antinomie does not upload evidence.
TShark runs in the same sandbox. It runs with every namespace unshared and sees only /usr, a few read-only /etc entries, a private /etc/passwd, a minimal /dev and /tmp, the capture (read-only) and a private scratch folder. Your session bus, X11 and Wayland sockets, /dev/shm, other mounts and the data directory are not visible. Its time, memory and output are bounded, and its output is checked before it is shown.
Guest disks are read in a sandbox. The Disks tab, and in 0.8.0 the reading of a changed file’s earlier bytes, parse a guest’s filesystem only in a separate worker under bubblewrap: no network, the disk image read-only, one writable folder and prlimit bounds. An imported qcow2 image is read by qemu-img in the same kind of sandbox, and an image with a backing file, an external data file or encryption is refused. Nothing is written to the VM’s disk.
Nothing from the guest runs on the host. Files extracted from a guest disk, saved File Reconstructions and the files in an evidence bundle are private copies that are never executable. Hand to Static Analysis analyses an extracted ELF offline in the analysis sandbox. Open with… hands a file to another application only after a warning that the application may render or run it.

What you should do

Use a dedicated analysis machine or a host you can rebuild, not the machine that holds your other work. A hypervisor escape is rare but possible.
Keep QEMU, the kernel and your host packages up to date, including tshark and Wireshark. They parse hostile data, such as the packets a sample sends.
Pick the weakest network mode that works. See Network isolation.
Use disposable guests. Take a snapshot of a clean VM and restore it, or use Reset disk to base…, instead of reusing a used guest.
Be careful with external tools. Opening a pcap in Wireshark, a core in a debugger, a dump in Volatility or another analyser, or an extracted file with Open with… runs those tools on hostile data, outside Antinomie’s sandbox. The Debugger tab’s gdb console and an external debugger run on the host and read the debugged process’s memory; they do not run the program on the host.
Open evidence bundles with care New in 0.8.0. Extracting the inner dropped-files.zip with its password puts live samples on disk; do that only on an analysis machine.
Remove samples you no longer need from Library → Samples. Remove keeps the sample’s record and custody log; the archive is deleted.
Mind your antivirus. Retained executables, the sample library, recordings and bundles can trigger it, and it may quarantine them. Exclude the data directory only if you accept that.
Know the law. Possessing and distributing malware can be regulated where you live.
Treat recordings as sensitive. See Recordings contain secrets.