What 6000+ Malware Samples Taught Me About Detection
Ransomware, RATs, droppers, info-stealers — after analysing over six thousand samples, the same lessons keep coming back. None of them are about clever reversing tricks. They're about what makes a detection survive the next variant.
Hashes die, behaviour lives
A new build changes every hash. What rarely changes is behaviour: the persistence key it writes, the way it injects, the order of its API calls. Detect the behaviour.
Triage fast, reverse deep only when needed
Most samples answer the key questions in minutes with the right tools.
- Static: Detect It Easy, PE Studio, strings and imports
- Dynamic: Procmon, RegShot, FakeNet in FLARE VM / REMnux
- Sandbox: ANY.RUN or Cuckoo for a quick behaviour map
- Deep: Ghidra or x64dbg only for what's still unclear
Write YARA rules for families, not files
Combine a few stable strings or byte patterns with a structural condition (file size range, imports, section names). Test against clean files before shipping, or your SOC will drown in noise.
Hand the SOC something it can act on
Every analysis ends with IOCs enriched in MISP and VirusTotal, the MITRE ATT&CK techniques observed, and at least one detection — YARA, Sigma or a SIEM query.
Tools mentioned
Malware analysis pays off when it ends in a detection that still fires on next month's variant.