Malware Reverse Engineering · Hacking Project

Reverse engineer a real-world malware sample end-to-end to derive capability, IOCs, and MITRE ATT&CK mappings.

**The problem**
Modern malware employs packing, obfuscation, anti-analysis, and living-off-the-land techniques that defeat signature-based detection and overwhelm under-staffed SOCs. Analysts who cannot statically and dynamically dissect a binary are unable to extract IOCs, map capability, or write reliable detections. This skills gap directly lengthens dwell time and weakens threat intelligence pipelines.

**What you'll build**
Build a structured RE workflow that combines static triage (PE/ELF parsing, string and import analysis, entropy/packing checks), disassembly/decompilation in Ghidra or IDA, and dynamic detonation inside an isolated, instrumented sandbox with network faking. Extract IOCs and behavioral TTPs, then codify findings into YARA and Sigma rules for detection engineering.

**Objective** — Reverse engineer a real-world malware sample end-to-end to derive capability, IOCs, and MITRE ATT&CK mappings.

**Expected outcome** — A full malware analysis report plus authored YARA/Sigma detection rules and an IOC set for a chosen sample family.

**Difficulty** — Advanced — requires assembly literacy, OS internals, and disciplined lab isolation, which sit well above intermediate scripting.

**Primary category** — Malware Analysis; Secondary = Threat Hunting, DFIR, Detection Engineering

**Security domains** — Primary = Malware Analysis; Secondary = Threat Intelligence, Incident Response, Security Research, Blue Team, Digital Forensics

**Technical focus** — Static analysis, Dynamic/behavioral analysis, Disassembly & decompilation, Unpacking/deobfuscation, PE/ELF internals, Anti-analysis evasion, Shellcode analysis, Sandboxing, IOC extraction, YARA/Sigma authoring

**Core technologies** — Languages: x86/x64 assembly, Python, C; Frameworks/Libraries: pefile, capstone, unicorn, yara-python, FLARE-VM tooling; Security Tools: Ghidra, IDA Free, x64dbg, Cuckoo/CAPE sandbox, PEStudio, Detect It Easy, Wireshark, INetSim/FakeNet-NG; Cloud/Infra: isolated VM (VirtualBox/VMware) with host-only networking; AI/Data: optional LLM-assisted decompilation triage; Databases: MISP or local IOC store

**Where it's valued** — Cybersecurity vendors, MSSP/MDR, financial services, government/defense, critical infrastructure, threat-intel firms

**Careers it builds toward** — Malware Analyst, Reverse Engineer, Threat Intelligence Analyst, Detection Engineer, DFIR Consultant

**Framework alignment**
• MITRE ATT&CK: Defense Evasion — Obfuscated Files or Information (T1027), Deobfuscate/Decode Files (T1140), Virtualization/Sandbox Evasion (T1497); Execution — Native API (T1106); Discovery techniques as observed per sample
• NIST CSF 2.0: Detect (DE.AE, DE.CM), Respond (RS.AN), Identify (ID.RA)
• OWASP: N/A
• CIS Controls v8: 8 (Audit Log Management), 10 (Malware Defenses), 13 (Network Monitoring and Defense)

**Innovation** — Improved Existing Solution — RE itself is established, but a repeatable workflow that auto-generates detections from analysis has real operational value. Scores: Innovation 6/10, Startup 5/10, Enterprise-Readiness 6/10, Patent = No.