malware-analysis-reversing

Malware Analysis & Reverse Engineering Architecture

Overview

This skill provides technical standards and defensive methodologies for malware analysis and reverse engineering. It covers isolated sandbox setup, static binary inspection (PE/ELF headers, imported functions, packed section detection), dynamic behavior monitoring, memory dump forensics, and authoring YARA rules for threat detection and incident response.

1. Malware Analysis Principles & Safety Protocols

1. Strict Air-Gapped / Isolated Sandbox: Always perform malware execution and dynamic monitoring inside isolated virtual machines (REMnux, FLARE VM) with network isolation (INetSim / FakeNet-NG) to prevent lateral movement or C2 callbacks to live networks.
2. Layered Analysis Methodology:
   • Static Triage: File hashing (MD5, SHA256, ssdeep), PE/ELF header analysis, string extraction, and packer detection (PEiD / Detect It Easy).
   • Dynamic Triage: API monitoring, registry/filesystem access tracking (ProcMon), network packet capturing (Wireshark).
   • Code-Level Disassembly / Decompilation: Reverse engineering control flow and functions using Ghidra or IDA Pro.
   • Memory Forensics: Extracting decrypted payloads or process injection artifacts from volatile memory dumps via Volatility 3.
3. Automated Indicator Extraction (IOCs): Extract high-confidence Indicators of Compromise (IP addresses, domain names, file hashes, registry run keys, mutexes) for SIEM ingest.
4. Defensive YARA Rule Generation: Write precise YARA detection rules targeting unique string signatures and byte patterns while minimizing false positives.

2. Reverse Engineering & Analysis Pipeline

[ Suspicious Binary Sample ]
       │
       ├──▶ [ 1. Static Analysis ] ──(Hashes, PE Headers, Import Table, Strings)
       │
       ├──▶ [ 2. Dynamic Sandbox ] ──(Process Trees, File/Registry Mutations, PCAP)
       │
       ├──▶ [ 3. Code Reversing ] ───(Ghidra Decompiler, Disassembly Control Flow)
       │
       └──▶ [ 4. Memory Forensics ] ─(Volatility 3 Dump, Extracted Payloads)
               │
               ▼
[ Threat Intelligence & YARA Detection Rules ]