Malware Reverse Engineering

Safety Boundary

• Treat samples as hostile. Use isolated labs, snapshots, no shared clipboard, no mounted personal directories, and controlled networking.
• Do not provide malware improvement, persistence, stealth, evasion, credential theft, or deployment guidance.
• Focus on behavior, indicators, detection, containment, and eradication.

Workflow

1. Record sample metadata: filename, hashes, size, type, source, timestamp, and handling notes.
2. Perform static triage: strings, imports, sections, packer hints, scripts/macros, config blobs, and suspicious capabilities.
3. Plan dynamic analysis with containment: VM snapshot, fake services, monitored filesystem/registry/process/network activity.
4. Summarize behavior by capability: execution, persistence, privilege, defense evasion, discovery, C2, collection, exfiltration.
5. Produce IOCs, detection logic ideas, remediation steps, and confidence levels.

Output Format