Handling and Responding to Malware Incidents
Know the families and their tells
Be able to distinguish virus (needs a host and user action), worm (self-propagating across the network), trojan (disguised as legitimate), ransomware (encryption plus extortion, often double extortion), rootkit (kernel/user-mode stealth and persistence), spyware/keylogger, botnet agent, logic bomb, fileless malware (lives in memory, PowerShell/WMI, registry), and cryptominers. Ransomware affiliates and APT tooling rarely arrive alone: expect a dropper, a persistence mechanism and a C2 channel.
Analysis: static, dynamic, sandbox
Static analysis inspects the file without running it: hashes, strings, PE headers/imports, packing, embedded URLs, YARA rules. Dynamic analysis runs it in an isolated environment (sandbox: Cuckoo, Joe Sandbox, CAPE; or a manually built VM with monitoring) and records file system, registry, process and network behaviour. Extract IOCs: file hashes, filenames, registry keys, mutexes, scheduled tasks, services, IPs, domains, URLs, JA3 fingerprints. Traps: a clean multi-engine VirusTotal score does not mean benign (fresh or targeted samples); never upload confidential samples to public services; polymorphic samples change hashes, so behavioural IOCs outlast file hashes.
The response sequence
Identify (AV/EDR alert, user report, ransom note, IDS hit) → scope (query EDR/SIEM for the IOC across the estate) → contain (isolate hosts, block C2 and hashes at proxy/firewall/DNS, disable compromised accounts) → eradicate (kill processes, remove persistence from Run keys, services, scheduled tasks, WMI subscriptions, remove the dropper, patch the entry vector) → recover (rebuild rather than clean where rootkit or kernel compromise is suspected; restore from offline backups; reimage, rotate credentials) → lessons learned.
Rule of thumb: with ransomware, protect and verify the backups first. An isolated, offline copy is the only thing that reliably survives; paying the ransom is not a recovery strategy.