B4: Exploit Development, RE & Malware Analysis
Malware Analysis: Safe Lab, Triage & Detection
Analyze suspicious binaries safely and produce indicators, behavior, and defensive recommendations.
- Use isolated VMs with snapshots, no shared clipboard/folders, and controlled networking.
- Collect static indicators: hashes, strings, imports, packer hints, certificates, and embedded URLs.
- Collect behavior: process tree, file writes, registry changes, network attempts, mutexes, persistence, and injection attempts.
- Write detections: YARA for file traits, Sigma/SIEM logic for behavior, and network indicators where stable.
- Handle samples legally and carefully; never upload client-sensitive malware to public services without permission.