mattmre/malware-triage-workflow

Malware Triage Workflow

Run a behavior-first triage that quickly answers what the sample touches, how risky it looks, and which routines deserve deep reverse engineering.

Workflow

1. Collect static indicators first:
   • format, architecture, packer or entropy clues
   • imports, exports, strings, sections, resources
   • suspicious APIs and network / filesystem / registry markers
   • YARA or family-pattern matches if available
2. Identify high-risk behavior buckets:
   • persistence
   • credential access
   • command and control
   • injection / hollowing
   • crypto / ransomware behavior
   • anti-analysis / sandbox checks
3. Select a small set of target functions for deeper decompilation.
4. Use debugger confirmation only for the riskiest unknowns:
   • decoded config
   • runtime-resolved imports
   • dropped paths
   • beacon construction
   • key material or encryption flow
5. Produce a short operator report before moving into full family-level RE.

Tool Families to Prefer

• binary_analysis_*triage*
• binary_analysis_*malware*
• binary_analysis_*yara*
• binary_analysis_*control*
• binary_analysis_*report*
• ghidra_headless_search.*
• ghidra_headless_reference.*
• ghidra_headless_decomp.function

Output Structure

1. Sample identity and format summary
2. Top suspicious indicators
3. Likely behavior categories
4. Priority functions / addresses for deeper RE
5. Dynamic checks still required
6. Confidence level and major unknowns