Basic Malware Analysis for Incident Responders
summary
Covers practical static-analysis steps: set up remnux or FLARE VMs, run file to identify architecture, use strings and floss extracts stacked strings to catch stack-encoded domains (example: HTTP evil.com), use regex or a Python script that runs strings + patterns to pull IPs/domains, write YARA rules (strings + condition) to flag samples, detect packing with Detect It Easy (entropy>7), upx -d unpacks UPX-packed binaries, use Ghidra to find hex hardcoded IPs (little-endian), then query SIEM/EDR/snort and verify before responding.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:50Malware analysis environments
- 3:59Goals of malware analysis
- 5:02Identifying file types
- 6:06Strings vs floss
- 7:29Stack strings evasion
- 9:58Regular expressions for IOCs
- 11:24Automating analysis with scripts
- 13:13Yara for signature detection
- 16:06Shell code evasion
- 16:48Hardcoded IP addresses
- 20:38Packed malware detection
- 23:26Using IOCs in response
- 24:53Summary and Q&A
related talks
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
47mDetecting and analyzing files-less malware
22mMalware Hunting - Using python as an attack weapon
01h 03mThe Dark Side of Malware Analysis
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
45m"Advanced Malware Threat: handling obfuscated code using..."
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
01h 05mThe Dark Side of Malware Analysis