blog.deeb.charticleA Idealistic View of Malware Analysis Definitions
A blog post attempting precise definitions for commonly confused malware analysis terms: static vs dynamic analysis, and heuristic vs deterministic (signature-based) detection. It uses a real YARA rule for PWS:Win32/Frethog.AB and the Mimikatz string 'Mimikatz_OpenInternalConfig()' to illustrate that signatures can be either precise/deterministic or generic/heuristic, and argues the heuristic/deterministic line is often blurry and context-dependent (e.g., LSASS access looking suspicious to a red teamer but normal to a sysadmin).
TL;DR Conceptual breakdown of static/dynamic analysis and heuristic vs. deterministic detection, with YARA and Mimikatz examples.
Organisations named here
- Mimikatz_OpenInternalConfig()
Technologies named here
- YARA
- .exe / PE format files
- Mimikatz
- LSASS process
- EDR
- ntdll hooking
- ETW
Techniques named here
- Static Analysis
- Dynamic analysis
- Memory scan
- Heuristic detection
- Deterministic/signature-based detection
- Process injection
- LSASS credential access
- Static emulation
Threat actors named here
- Mimikatz
- PWS:Win32/Frethog.AB
Related in Malware & RE
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupPost-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
huntress.comwriteupClickFix Removes Your Background but Leaves the Malware
