Reverse Engineering
Malware Reverse Engineering
We analyze malware found in an incident to determine its actions and where else to search for it.
What it is
A malware sample recovered in an incident is the most direct way to understand the impact of the attack. The analysis identifies the sample's functions, communication methods and persistence mechanisms. It determines which server the malware connects to and what data it targets. This information is used to create detection rules to search for the same malware on other systems.
Scope
- Analyzing the malware sample in a controlled, isolated environment
- Identifying its functions and command-and-control communication
- Identifying persistence mechanisms and spreading methods
- Deriving indicators and detection rules to search on other systems
- Mapping the behavior to MITRE ATT&CK techniques
The need
When organizations need it
- When you need to determine what malware found in an incident does and where else to search for it.
- When it must be clarified whether an alert is a real threat or a false alarm.
- When, after an incident, you need to check if the same malware is present elsewhere in the environment.
Method
How we work
-
Isolation
We examine the sample in a controlled environment isolated from the internet and your network.
-
Analysis
We analyze its functions, communication and persistence, and map them to ATT&CK techniques.
-
Indicators
We create detection rules and indicators to search on other systems.
Outcome
What you have at the end
A documented analysis of what the malware does and indicators ready for direct use in detection rules to help you search elsewhere in the environment.
Frequently asked questions
Can malware spread during analysis?
No. The sample is examined in a controlled environment isolated from the internet and your network. This prevents any risk of spreading.
Can our SOC team use the result?
Yes. We provide the indicators and detection rules in a format your SOC or detection team can use directly.
Reverse Engineering
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting