Unclear Antivirus or EDR Alert
A generic detection – but what the file can do, whether it was executed and whether other systems are affected remains unclear.
Incident Response & Forensics
Malware Analysis: Understand the Malware, Contain the Attack
Know what the malware can do.
An EDR alert, a suspicious attachment, an unknown program on a server: with our malware analysis, we determine what the malware does, who it communicates with and how it persists. You receive indicators of compromise (IoCs) and detection rules that help your team find infected systems and contain the attack in a targeted way.
- 24/7 emergency hotline
- Isolated analysis environment
- IoCs & detection rules
Definition
What Is Malware Analysis?
Malware analysis is the systematic examination of malicious software to understand how it works, its role in the attack and its impact. It answers the questions that determine the next steps in an incident: What can the program do, how did it get onto the system, how does it stay active, which servers does it communicate with – and which data might have been exfiltrated?
An antivirus or EDR detection usually provides only a generic name. Whether it’s adware, an infostealer, a remote access trojan or a loader that later downloads ransomware makes a big difference to your response.
The results feed directly into incident handling – from blocking and cleanup to resetting credentials. The analysis is closely integrated with our Digital Forensics services; the indicators obtained can also be used to perform a Compromise Assessment of the entire environment.
The result also matters for reporting obligations: if the malware was able to access or exfiltrate personal data, you need to check whether there is a reportable personal data breach under Art. 33 GDPR. For organizations covered by NIS2, the findings also feed into the assessment of whether a significant incident has occurred. We provide the technical facts; you make the legal assessment together with your legal counsel.
Our Approach
How We Analyze Malware – Safely and Step by Step
Before we analyze malware, we make sure it’s handled safely: we receive samples in encrypted form and documented with hash values, and analysis takes place in an isolated lab environment with no connection to your network. We use public analysis platforms only with your consent – an upload can expose confidential data and alert the attackers.
We take a staged approach: triage and static analysis show what we’re dealing with. In a sandbox and in controlled virtual machines, we observe which processes the malware starts, what it changes and which connections it establishes. Where necessary, we dissect individual functions through reverse engineering – for example, to uncover encrypted configurations.
Your team receives the first indicators as soon as they’re reliable – not just with the report. We map all findings to MITRE ATT&CK and translate them into detection rules and network indicators.
Typical Triggers
When Malware Analysis Makes Sense
Suspicious Attachment or Download
Office documents with macros, scripts, LNK, ISO or HTML files were opened. We determine what happened in the background and what was downloaded.
Ransomware Incident
We analyze the encryption program and the attackers’ tools – variant, propagation and deletion functions – and check whether a public decryption tool exists, for example through the No More Ransom initiative.
Infostealers and Stolen Credentials
If malware harvests passwords, browser sessions or tokens, it must be clear which accounts are affected – as the basis for targeted lockouts.
Backdoors and Remote Access
Backdoors, remote access trojans and web shells give attackers persistent access. We determine the command set, communication channels and persistence so that the access can be cut off completely.
Malware on Servers and Appliances
Cryptominers, botnet clients or implants on Linux servers, web servers or network devices often go undetected for a long time.
Depth of Analysis as Needed
Three Levels of Malware Analysis
Not every question requires full reverse engineering. We choose the depth based on your question and only go deeper after consulting you.
Triage
Initial Assessment
Is the file malicious, which family does it belong to, and which initial indicators can be derived?
- Classification and threat intelligence check
- First IoCs for blocking and hunting
- Recommendation for next steps
Static & Dynamic
Behavioral Analysis
Static examination and controlled execution show what the malware can do and how it communicates.
- Sandbox and manual dynamic analysis
- C2, persistence, propagation, data exfiltration
- YARA and Sigma rules
Reverse Engineering
In-Depth Analysis
Analysis of relevant functions down to code level – when encryption, protocols or purpose-built implants need to be understood.
- Decryption of configurations and protocols
- Bypassing anti-analysis techniques
- Detailed technical report
Process
Steps of a Malware Analysis
Embedded in incident handling within our Incident Response & Forensics practice – based on guidance such as ISO/IEC 27035 and NIST SP 800-61 Rev. 3.
-
01
First Contact & Key Questions
Via the 24/7 emergency hotline, the emergency form or the contact form. We clarify what happened and which questions the analysis should answer; you receive an individual quote.
-
02
Secure Handover
We receive samples, memory images and logs in encrypted form and documented with hash values – or secure them ourselves, remotely or on-site.
-
03
Triage & First Indicators
Classification and first IoCs that your team can use to block connections and narrow down affected systems.
-
04
Analysis & Reverse Engineering
Static and dynamic analysis of C2, persistence, propagation and data exfiltration – down to function level if required.
-
05
Detection & Cleanup
YARA and Sigma rules for hunting across the entire environment, plus guidance on which persistence mechanisms and accounts need to be cleaned up.
-
06
Report & Follow-Up
Analysis report and lessons learned. A penetration test or a red teaming engagement can later show whether hardening and detection work – you can describe the scope via our Pentest Quote page.
Analysis Report
The Analysis Report: Clear for Management, Actionable for Your Security Team
The report answers what the malware can do, what risk it poses and what needs to be done now – with all indicators and rules in a directly usable form. The handling and hash values of the samples are documented so that the results fit into an overall forensic report.
- Executive summary with capabilities, risk and need for action
- Infection chain, persistence and C2 communication in detail
- Mapping to MITRE ATT&CK
- IoC list, also machine-readable
- YARA and Sigma rules plus network indicators
- Recommendations for containment, cleanup and hardening
Unknown Malware in Your Network?
The sooner you know what the malware can do, the more precisely you can act. In an acute case, call our 24/7 emergency hotline – including at night and on weekends.
FAQ
Frequently Asked Questions About Malware Analysis
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
How do we send you a suspicious file securely?
Please don’t simply send it by email – filters will block the file, or it may be opened by mistake. A proven method is an encrypted, password-protected archive that you transfer via a channel agreed with us; share the password separately, for example by phone. If you prefer, we can also secure samples and memory images ourselves, remotely or on-site.
Isn’t it enough to upload the file to an online scanner?
For an initial assessment, perhaps – but uploaded files are often accessible to third parties there, including attackers who watch whether their tools have been detected. Targeted malware can also contain internal information such as domain names or credentials. And a detection name doesn’t reveal what the software did in your environment.
What’s the difference between static and dynamic analysis?
In static analysis, we examine the file without executing it; in dynamic analysis, we run it in an isolated environment and observe its behavior. The two complement each other: some malware detects sandboxes and behaves inconspicuously there, while other malware obfuscates its code so heavily that only execution provides clarity.
How do the results help with containment?
Domains and IP addresses can be blocked at the firewall, proxy and DNS level to cut the connection to the attackers – ideally in a coordinated way so that they aren’t warned prematurely. With hash values, YARA and Sigma rules, you can find further infected systems. The persistence mechanisms show what needs to be removed; the capabilities – such as harvesting browser passwords – indicate which credentials need to be reset.
Can you recover encrypted data after a ransomware attack?
That can’t be promised. Modern ransomware usually encrypts in such a way that decryption is impossible without the attackers’ key – which is why intact backups are crucial for recovery. However, the analysis shows which variant you’re dealing with and whether public decryption tools exist, for example via No More Ransom. Learn more under Ransomware Response.
How does malware analysis differ from reverse engineering in a code review?
The methods are similar, but the goal and context are not. In Code Review & Reverse Engineering, we assess legitimate software, apps or firmware for vulnerabilities as a planned engagement. Malware analysis examines hostile code in the context of an attack – with the goal of obtaining actionable indicators for containment and detection.
How is a malware analysis billed?
We quote each malware analysis individually. The effort depends mainly on the depth of analysis; we agree on any deeper analysis with you in advance.
Related pages
Found a Suspicious File? Talk to Us
Briefly describe what you found – for example, the file name, location and alert message. Please don’t send the file itself by email; we’ll agree on the transfer method with you. In an acute case, you can reach our 24/7 emergency hotline at +49 2932 465265-0 or use the emergency form.