Malware Analysis Basics — Dissecting Viruses & Trojans

Malware Analysis — Understanding the Enemy

Malware analysts earn ₹15-40 LPA in India. They dissect malicious software to understand how it works and how to stop it.

Types of Malware

• 🦠 Virus: Attaches to files, spreads when file is shared
• 🐛 Worm: Self-replicating, spreads across networks automatically
• 🐴 Trojan: Disguised as legitimate software
• 💰 Ransomware: Encrypts files, demands payment
• 🕵️ Spyware: Silently monitors user activity
• ⛏️ Cryptominer: Uses your CPU/GPU to mine cryptocurrency
• 🚪 Rootkit: Hides deep in the OS, extremely hard to detect

Static Analysis

Analyze malware WITHOUT executing it:

# File identification
file malware.exe
strings malware.exe | grep -i "http\|password\|key"

# Hash check
md5sum malware.exe
# Check hash on VirusTotal

# PE analysis
pefile malware.exe           # Python pefile library
# Look for: imported DLLs, suspicious functions

Dynamic Analysis

Run malware in a sandbox and observe behavior:

# Tools:
# - Cuckoo Sandbox (automated)
# - Process Monitor (filesystem/registry changes)
# - Wireshark (network communication)
# - RegShot (before/after registry comparison)
# - FakeNet (simulate network services)

What Malware Typically Does

1. Disable antivirus
2. Establish persistence (auto-start)
3. Contact C2 server for instructions
4. Download additional payloads
5. Exfiltrate data or encrypt files

🔥 Learn malware analysis at ONLY4YOU →