---
title: "Malware Analysis — Canonical Reference · VORNAC Research"
description: "Triage workflow, packer recognition, behavioral exploit profile, RAT family-behavior reference, and the template for documenting a sustained adversary group."
url: https://www.vornac.com/en/research/reverse-malware/malware-analysis-canon
lang: en
published: 2026-06-02
updated: 2026-06-02
alternate_de: https://www.vornac.com/research/reverse-malware/malware-analysis-canon
---

[Research Index](https://www.vornac.com/en/research) / [6 · Reverse Engineering, Binary & Malware](https://www.vornac.com/en/research/reverse-malware) / Malware Analysis — Canonical Reference

Background · [6 Reverse Engineering, Binary & Malware](https://www.vornac.com/en/research/reverse-malware)

# Malware Analysis — Canonical Reference.

Triage workflow, packer recognition, behavioral exploit profile, RAT family-behavior reference, and the template for documenting a sustained adversary group.

## Triage pipeline

1.  **Hash & reputation.** SHA-256 against VirusTotal, MalwareBazaar, Hybrid Analysis. Known sample = use existing analysis as starting point.
2.  **Static features.** File type, sections, imports, strings, certs, resources, overlay. Extract with `pestudio`, `capa`, `floss`.
3.  **capa rules.** Maps code patterns to MITRE ATT&CK techniques. Quick capability inventory without execution.
4.  **Sandbox detonation.** Cuckoo / Cape / Hatching Triage. Captures network, filesystem, registry, process tree.
5.  **Manual gate.** Auto-analysis confidence low (heavy obfuscation, anti-VM, custom packer) → escalate to manual reverse-engineering.

## Packer recognition + unpacking

-   **UPX.** Section names `UPX0`, `UPX1`. `upx -d` unpacks. Most common, easiest.
-   **Themida / VMProtect.** Detected by Detect-It-Easy. Virtualization-based: rewrites code into custom bytecode interpreted at runtime. Weeks of manual work.
-   **ASPack, PECompact, MPRESS.** Older commercial packers. Generic unpacker (`UnpacMe`, `de4dot` for .NET) often handles.
-   **Custom packer.** No vendor signature; entry-point stub allocates RWX, decrypts, JMP into decrypted code. Set hardware breakpoint on the OEP candidate after the long decryption loop.
-   **Generic unpacking flow.** Trace until VirtualAlloc + WriteProcessMemory + transfer of control (CALL, JMP) into the new region. That's OEP. Dump from memory, fix IAT with `Scylla`, reconstruct PE.

## Behavioral profile separated from payload

-   **Exploit-stage behavior.** Process spawned (often unusual: WINWORD spawning powershell), file written to %TEMP%, registry mutation in Run/RunOnce, network beacon to never-before-seen host.
-   **Payload-stage behavior (varies by family).** Credential dump (LSASS access), keylogger (low-level hook install), persistence (scheduled task created), C2 (DNS or HTTPS beacon).
-   **Why separate.** One detection on exploit-stage behavior catches the entire population; per-payload detection scales linearly with families.

## RAT generations

-   **Gen 1 (2000s).** PoisonIvy, Sub7, Bifrost. GUI-driven, direct TCP C2, no encryption. Trivially detected today.
-   **Gen 2 (early 2010s).** Gh0st, DarkComet, njRAT. Custom protocols, basic obfuscation, modular plugins.
-   **Gen 3 (mid-2010s).** AsyncRAT, NanoCore. HTTPS C2, simple anti-analysis, builder-driven so many derivatives.
-   **Gen 4 (late 2010s onward).** Cobalt Strike, Sliver, Mythic, Brute Ratel. Operator framework, beacon protocols designed for stealth (jitter, sleep mask, domain fronting), modular post-ex.
-   **Gen 5 (current).** Custom toolchains by sophisticated actors. Memory-only payloads, EDR-evasion built in (direct syscalls, indirect syscalls, AMSI patches, ETW patches). Often single-use per intrusion.

## APT group template — adding a new actor

-   **Tooling.** Custom malware families, public tooling preferences, exploit kit choices.
-   **Infrastructure.** Hosting pattern (bulletproof, cloud, compromised), domain-registration habits, certificate patterns.
-   **Victimology.** Sectors targeted, geographic targeting, victim selection criteria (opportunistic vs strategic).
-   **Confidence.** Per claim: primary observation / public report / inferred. Distinguish what your team observed from what the broader community has published.

**Rule of thumb**For automated triage to be useful at scale, the workflow must surface "low confidence, escalate" cleanly. A pipeline that outputs binary "benign/malicious" misses the bucket where most analyst value lives — the "interesting, look closer" sample.

Domain

[6 · Reverse Engineering, Binary & Malware](https://www.vornac.com/en/research/reverse-malware)

Tier

Background

Engagement phases

No specific phase

Published

2 June 2026

Looking up an acronym?

[Open the Glossary](https://www.vornac.com/en/glossary)

## Related notes in this domain

-   [Background Binary Exploitation — Fuzz to Working Exploit](https://www.vornac.com/en/research/reverse-malware/binary-exploitation-pipeline)
-   [Background Reverse Engineering Fundamentals](https://www.vornac.com/en/research/reverse-malware/reverse-engineering-fundamentals)
-   [Background Document & Runtime Exploits](https://www.vornac.com/en/research/reverse-malware/document-and-runtime-exploits)

[Previous note Reverse Engineering Fundamentals](https://www.vornac.com/en/research/reverse-malware/reverse-engineering-fundamentals) [Back to domain](https://www.vornac.com/en/research/reverse-malware) [Next note Document & Runtime Exploits](https://www.vornac.com/en/research/reverse-malware/document-and-runtime-exploits)

From reference to evidence

## Run this against your own environment.