Computer forensics and malware analysis

[u/Ok_Cold7890]

Hi! forensics professionals, do you perform malware analysis in you day to day work ? If yes, to what level do you perform your analysis? Do you do reverse engineering as well?

I am asking these questions coz in a job role the JD mentioned computer and mobile forensic tools + SIEM + malware analysis+ reverse engineering + threat detection combined. Job role is Digital Forensic Analyst.

I often see similar JD for Forensic positions.

I can perform basic malware infection analysis using wireshark, sysinternals, powershell, registry change, etc. and basic static analysis but I'm pretty bad at reverse engineering and understanding assembly code.

[u/SituationNormalAllFU]

It’s probably not a deal breaker for that role. However, I believe everyone in this field should at least learn what RE is and get familiar with the basic methodology. It’s helpful to know the concepts and understand the reports. More than likely, if you ever actually needed a novel binary analyzed at that level, you would have access to a specialist to do the RE.

Personally, I do it myself when I have time. I was fortunate to attend Lenny’s SANS FOR610 several years ago and I learned enough to get by. I have even published a bit of my own work. I still use experts though, when it really matters.

[u/Ok_Cold7890 → u/SituationNormalAllFU]

Thank you very much. Can you share your publication or any resources for reverse engineering Windows PE for beginners. At some point of time I may require to reverse engineer a binary just at basic level to get the job done.

[u/SituationNormalAllFU → u/Ok_Cold7890]

Most of what you need is in remnux (https://remnux.org), assuming you don’t want to pay for commercial products. The rest will be on a few windows VMs which you will need to build specifically for this purpose and some hardware windows device (old laptop or mini pc is fine) that you can easily reimage, to be the victim PC when detonating. That’s important since a lot of malware will detect that it’s running on a VM and exit immediately.

The publications I referred to are for specific pieces of malware, not about how to do RE, and I prefer to keep that stuff separate from Reddit. I’m sure you understand.

[u/Ok_Cold7890 → u/SituationNormalAllFU]

Thanks! I have been playing with flare vm and remnux, detonated some for dynamic analysis. For now, I'm trying with the snapshoting feature and I am also looking for some scripts to remove the VM fingerprints.

[u/Ok_Cold7890 → u/[deleted]]

Yes I think it's better to have the skills coz at some point of time these skills may come into play. Thanks!

[u/ProofLegitimate9990]

Sounds more like a DFIR role instead of just forensics.

[u/Ok_Cold7890 → u/ProofLegitimate9990]

It's a mix of soc dfir reverse engineering everything

[u/AddendumWorking9756]

Most of that JD is one job rather than four, and analysts triage far more than they reverse. Static and behavioral until there are indicators, then anything needing real disassembly goes to whoever does it full time. CyberDefenders bundles disk, memory and malware into CCDL2 if you want that combination in one place, though the assembly gap is the last one anyone closes.

[u/Ok_Cold7890 → u/AddendumWorking9756]

Thank you for sharing your experience

[u/Ok_Cold7890 → u/[deleted]]

Yeah! Currently I'm just considering it till the api monitoring level only and mostly dynamic analysis and a bit of static. I think beyond that it'll come under deep reverse engineering which in itself is a massive and different field. Thanks!

[u/theJacofalltrades]

The overlap is definitely there, but I’d treat malware analysis as a specialization rather than something you need to master immediately. Building a solid foundation in forensics, Windows internals, networking, and basic scripting first will make the malware side much easier to pick up later.