If you're looking to build your own malware lab using open-source tools to take your GREM skills to the next level, take a look at Robert Simmons' of ThreatConnect's talk at VirusBulletin from a few months ago. Has a brief paper, but the video is people what you want to look at if you are new to all this. In essence, it is set up of the following components: Cuckoo Sandbox (with some modications), volatility (for memory analysis), thug (for a low interaction honeyclient), and Bro (for network analysis).  It probably would only take a half-day of your time to set up and you can be off to the races on analyzing malware that's fresh off the wire.

Couple of notes, always be sure to do this from a non-attributed network (i.e. not your company).  Sandboxing involves running actual malware so it will set off the IDS.  Many of my sandbox systems run behind a pfsense firewall that connects to a commodity VPN so I can't easily be directly tied to things and has the advantages of letting me change what country I "am in" as malware may behave differently when it thinks it is running in different countries.

Take a look and let us know if you find more interesting things out there with your malware hunting efforts.

--
John Bambenek
bambenek \at\ gmail /dot/ com
Fidelis Cybersecurity