Malware analysis: Collaboration, automation and training

Whether you’re a novice or a professional at analyzing malicious code, you’ll have a desire to learn or pass on that skill.

Most malicious code analysis is performed by a single analyst, some times with collaboration tools for sharing comments on code between two or more analysts.

In this video from Shmoocon 2013, Richard Harman teaches you how to set up a virtualized analysis environment that is suitable for solo analysis, training a classroom of students, passing an analysis VM between analysts, and a self-service analysis “session” playback of previous analysis sessions. All of this while not getting in your way, and making efficient use of RAM and disk space.

Richard Harman is an incident responder at SRA International’s internal Security Operations Center, where he slings Perl code supporting incident response and performs analysis & reverse engineering of targeted attack malware samples.

If you’re interested in the field of malware analysis, read our article on becoming a malware analyst with commentary from McAfee, Avast, Bitdefender, Kaspersky Lab, FortiGuard and Symantec.