Malware Analysis Basics

⚠️ Detonate only in an isolated, snapshotted VM with no network path to anything you care about. Mishandling live malware can infect your machine or network. See Building a Home Pentest Lab.

Malware analysis figures out what a sample does — its capabilities, indicators, and intent — without becoming its next victim.

#Lab safety first

• Dedicated analysis VM (REMnux / FLARE-VM), host-only networking, snapshot before and revert after.
• Never analyze on your daily driver.

#Static triage (don't run it)

file sample.exe                      # type
sha256sum sample.exe                 # hash → check VirusTotal
strings -n 8 sample.exe | less       # URLs, IPs, commands, keys

Then disassemble in Ghidra for deeper logic.

#Dynamic triage (run it, watched)

#Output: IOCs

Indicators of Compromise — hashes, domains, IPs, file paths — feed straight into detection (Log Analysis and SIEM).

Related: Reverse Engineering with Ghidra · Log Analysis and SIEM · Building a Home Pentest Lab