Malware analysis & reverse engineering
Capability analysis, configuration extraction, and detection content, derived from the sample itself.
Sandbox output tells you behaviour. You need capability.
A detonation report tells you what a sample did in the two minutes it ran, in an environment it could tell was a sandbox, without the command-and-control server that would have told it what to do next.
That is a lower bound on capability. Treating it as the answer is how incident scope gets set too narrow.
The questions that actually drive a response — what else can this do, what did it touch, how long was it there, is it still there — are answered by taking the sample apart.
What you get
- A capability report: what the sample can do, not only what it did when observed — including functionality gated behind checks it did not pass, and code paths waiting on operator instruction.
- Indicators of compromise — host, network, behavioural — each with its confidence and how it was derived, so your detection engineers can judge false-positive risk before deploying.
- Persistence and privilege analysis: how it survives reboot, what it needs to run, what it can reach.
- Configuration extraction — C2 infrastructure, campaign identifiers, keys, embedded config — including decoding custom obfuscation and packing.
- Attribution signals, labelled as signals. Code reuse, toolmark similarity, infrastructure overlap. We report what the evidence supports and explicitly not more.
- Detection content — YARA rules and behavioural signatures, tested against the sample and against a benign corpus, so you know the false-positive profile before it reaches production.
- A scope-impact statement: what this sample's presence tells you about what else to check.
How we work
- Static analysis and disassembly of the unpacked sample; custom unpackers where needed
- Controlled dynamic analysis in an isolated environment, with anti-analysis and sandbox-detection checks neutralized so the sample reveals behaviour it otherwise withholds
- Deobfuscation of packing, string encryption, control-flow flattening, and API resolution
- Network protocol reconstruction, including custom and encrypted C2
- Family comparison assessed structurally rather than by hash
- Where relevant: firmware, bootkit, and driver-level analysis
On urgency, honestly
Deep reverse engineering takes the time it takes. A packed, obfuscated sample with a custom protocol is days of work, not hours.
What we can do quickly is a triage pass — family identification, obvious capability, immediate IOCs, and a scoping assessment — usually within one business day, so your containment decisions are not waiting on the full analysis. Full analysis follows.
We would rather set that expectation before an engagement than miss a deadline during one.
Engagement shapes
| Shape | Fits | Typical duration |
|---|---|---|
| Triage | Family, capability, immediate IOCs, scoping | ~1 business day |
| Full analysis | Complete capability, config extraction, detection content | 3–10 days |
| Campaign analysis | Multiple related samples, evolution over time | 2–4 weeks |
| IR retainer | Pre-agreed terms so contracting is not on the critical path | ongoing |
If you expect to need this under time pressure, set the retainer up before you need it. The slowest part of an urgent engagement is almost always procurement, not analysis.
Questions we get asked
How fast can you start? Triage typically within one business day for retainer clients. Without a retainer, contracting is usually the bottleneck — which is the argument for arranging one in advance.
Can you support litigation or an insurance claim? We produce documented, reproducible analysis with a clear chain of reasoning, and we are explicit about what the evidence does and does not support. We are not a forensics firm and do not hold ourselves out as expert witnesses; where that is needed we work alongside one.
Will you attribute the attack? We report attribution signals and what they support. A single sample rarely supports confident attribution, and saying otherwise would be a disservice — attribution errors change how an organization responds.
Can we send you the sample? Yes, under NDA, through a channel agreed at engagement start. PGP key on the contact page. Samples are handled in an isolated environment and retained or destroyed per your instruction.
Do you publish research on samples you analyze? Not client incident work — that is yours and stays yours.
Start a conversation · hello@rev3rse.dev