analyzing-malware

Analyzing Malware

The analysis is the easy part. The part that goes wrong is containment: a sample detonated on a machine that can reach production, or an IOC published that burns an active investigation. Get the environment right first.

When to Use

• Triaging a suspicious file, attachment, script, or dropped binary
• Determining a sample's capability, persistence, and command-and-control
• Extracting indicators for hunting and blocking
• Writing YARA or behavioural detection from a specimen
• Supporting an incident with sample-derived intelligence

When NOT to Use

• Writing malware, droppers, loaders, or evasion code — out of scope for this skill regardless of framing
• Pure RE of a benign binary — use analyzing-binaries
• A raw shellcode blob with no PE/ELF header — use analyzing-shellcode
• The sample's network capture — use analyzing-network-traffic
• Sweeping a whole web source tree for planted webshells (not one recovered sample) — use hunting-web-backdoors
• Writing a YARA signature for the family — use writing-yara-rules
• The wider incident — use responding-to-incidents
• Turning findings into deployed rules — use engineering-detections
• Pivoting sample IOCs into related infrastructure, actor tracking, or a finished intel product — use producing-threat-intelligence

Containment: Do This Before Anything Else

Control	Requirement
Host	Disposable VM or dedicated bare-metal, snapshot taken before execution
Network	Isolated segment; simulated services (INetSim/FakeNet-NG) by default
Shares	No host folder sharing, no clipboard sharing, no mounted host drives
Credentials	No real accounts, no domain join, no password manager
Handling	Sample stored in a password-protected archive, extension neutered (.bin, .mal)
Egress	Real internet only with an explicit decision and a plan for attribution leakage

Live C2 contact tells the operator you are looking. On an active incident, do not resolve the C2 domain, submit the hash publicly, or upload the sample to a multi-scanner service until the incident lead approves it — public submission is a disclosure.