Malware Concepts, Analysis and Defensive Triage — DedSec Project

Malware is software or code intentionally used to violate a security property: steal information, disrupt operations, gain unauthorized control, persist, spy, encrypt data, or abuse system resources. Security professionals need to understand malware behavior without developing or deploying harmful code.

Authorized-use boundary: Analyze malware only in an isolated environment you control and only when you are authorized to possess the sample. Prefer harmless training samples, known test strings, prerecorded telemetry, or intentionally non-malicious binaries when learning.

Learning objectives

• classify malware by behavior rather than sensational labels;
• understand infection, execution, persistence, command-and-control, and impact as behavioral stages;
• perform safe static and behavioral triage;
• identify useful host and network evidence;
• distinguish indicators of compromise from durable behavioral detections;
• design containment and recovery steps.

Malware categories

Common labels include trojan, worm, ransomware, spyware, downloader, bot, rootkit, wiper, cryptominer, and information stealer. Real malware can combine several behaviors, so defenders should record what the sample actually does rather than assuming the label describes every capability.

Initial triage

Before execution, collect basic evidence:

• cryptographic hash;
• file type and architecture;
• digital-signature status;
• size and timestamps, while remembering timestamps can be misleading;
• printable strings and embedded configuration where safe;
• import/library information;
• packaging or compression indicators;
• source and chain of custody.

Do not upload confidential samples or documents to public analysis services unless policy explicitly permits it.

Static analysis

Static analysis inspects a file without running it. It can reveal executable format, imported APIs, strings, resources, metadata, and code structure. Obfuscation and packing reduce visibility, so absence of obvious malicious strings is not evidence of safety.

Modules 64, 67, and 79 cover executable formats, reverse engineering, and malware analysis in greater depth.

Behavioral analysis

Behavioral analysis observes what a sample does in a controlled sandbox. Useful evidence includes:

• process tree and parent/child relationships;
• file and registry/configuration changes;
• service or scheduled-task changes;
• DNS and network destinations;
• loaded libraries;
• authentication or privilege events;
• security-control changes;
• created mutexes, sockets, pipes, or other IPC objects.

A learning lab should use a harmless program that performs known actions, such as creating a file, starting a child process, and making a request to a localhost service. The objective is learning telemetry, not creating malicious behavior.

Persistence and privilege

Persistence describes mechanisms that cause code to execute again later. Privilege describes the authority available to that code. They are separate questions: a persistent process can have low privilege, while a one-time process can execute with high privilege.

Defenders should baseline services, scheduled tasks, startup items, extensions, and other autorun mechanisms and investigate unexpected changes.

Command-and-control concepts

Remote-control malware needs some way to receive instructions or exfiltrate results. Defenders analyze protocol, destination reputation, certificate/DNS metadata, timing, beacon regularity, process ownership, and the relationship between network traffic and host activity. Do not reproduce real command-and-control infrastructure for learning; use localhost or prerecorded packet captures.

Ransomware and destructive behavior

Ransomware resilience depends on prevention, detection, segmentation, least privilege, protected backups, restoration testing, and incident response. Never test encryption or destructive payloads against real user data. Module 38 covers ransomware resilience and recovery.

Indicators and detections

An indicator of compromise (IOC) might be a hash, domain, filename, or registry path. IOCs can be useful but often change quickly. Behavioral detections can be more durable because they describe suspicious relationships, such as an unexpected office application spawning a script interpreter or an unsigned process changing a protected startup location.

High-quality detections include context: actor/process, target resource, operation, result, time, and expected baseline.

Containment and recovery

A generic response sequence is:

1. validate the alert and preserve evidence;
2. isolate affected systems if necessary;
3. identify impacted identities and secrets;
4. stop propagation while maintaining investigation visibility;
5. eradicate the root cause;
6. restore from trusted sources;
7. rotate compromised credentials or keys;
8. monitor for recurrence;
9. document lessons learned.

Common mistakes

• Executing unknown samples on a personal device.
• Disabling security controls just to make a sample run.
• Treating one antivirus label as a complete analysis.
• Focusing only on hashes and ignoring behavior.
• Uploading confidential samples to public services.
• Restoring systems without addressing the initial access path.

Safe lab

Write a small benign script that creates a temporary file, launches a harmless child process, and writes one log entry. Observe the process tree and filesystem changes using built-in tools. Document what telemetry would allow a defender to distinguish the activity from normal software behavior.

Knowledge check

1. Why is a malware family label insufficient for analysis?
2. What is the difference between an IOC and a behavioral detection?
3. Why should static and behavioral analysis be combined?
4. What evidence should be collected before executing a suspicious sample?
5. Why is restoration alone insufficient after ransomware?

Guided study workflow

Use the shared Study Method. Keep all practical work harmless and isolated; the goal is analysis, detection, containment, and recovery.

Continue with

Recommended next modules: 23, 37, 67, 79, 81.