Malware Frank

Malware analysis related tools/techniques/research

[Moritz @m_r_tz]

Check out capa v4 with:
1. support for analyzing .NET executables
2. finer grained capability detection via instruction and operand features
3. many new and updated detection rules
Blog: https://t.co/0WPjK5jKNI
Binaries: https://t.co/QPpiGZgtap
Source: https://t.co/gWbLkjgYG9

[Malware Frank @MalwareFrank]

The specifics change over the years, but these days I recommend reading reporting on @malpedia website, searching for and downloading related samples on #malwarebazaar website, and setting up FLAREVM

[Malware Frank @MalwareFrank]

A college student recently asked me how to learn more about malware analysis. Apart from online tutorials and expensive training, I recommend reading others’ analyses and trying to replicate their findings. Even after all these years, I always learn something when I do that

[Malware Frank @MalwareFrank]

This is true for malware analysis as well. Just replace SIEM with IDA/Ghidra/dnSpyEx/etc and read

[Chris Sanders 🔎 🧠 @chrissanders88]

One of the bigger initial barriers for newer analysts to break through is understanding exactly where investigative work happens. Much of it happens in the web browser and search engine rather than the SIEM or command line. 1/

[ESET Research @ESETresearch]

Code similarity is a common and powerful way to cluster malware samples and make connections between seemingly unrelated malware families. Although it sounds simple, it is actually a complex problem and is hard to automate at scale without generating false positives. 1/

[Malware Frank @MalwareFrank]

We need a common instruction-level trace file format that different tools can produce and others can consume

[Malware Frank @MalwareFrank]

Bugfix release of dnfile, parsing .NET binaries from Python. Thanks for the PRs! https://t.co/eLZ2j5HZNM

[Malware Frank @MalwareFrank]

If you can understand how a specific malware sample was made, you are closer to unwrapping it and seeing the bits that express its true functionality

[Malware Frank @MalwareFrank]

@ap0x @ReversingLabs Thanks. Interface and method names, or also the data types of inputs and outputs for them?