How to Investigate Malware
An evidence-led workflow for investigating a malware family: establish identity and attribution, understand behavior, map techniques, find IOCs, and connect the intelligence to detection and investigation.
Quick Answer
To investigate malware, confirm the family identity and aliases, describe its behavior and targets, map its techniques with ATT&CK, collect published IOCs, then link the family to campaigns and start detection with an investigation.
Definition
Malware investigation is the process of building a structured picture of a malicious program family — who, what it does, what it targets, which techniques it uses, and what IOCs are reported.
Answer first
Investigate malware in order: identity → behavior → techniques → IOCs → detection.
1. Establish identity
Confirm the family name, aliases and the type (RAT, ransomware, loader, botnet, etc.). Note the source of attribution.
2. Describe behavior
Summarize what the sample does: initial access, persistence, defense evasion, lateral movement, data impact. Base this only on published evidence or analysis you can cite.
3. Map techniques
Map behavior to MITRE ATT&CK techniques so other analysts can search and compare.
4. Collect IOCs
Gather published hashes, domains, URLs and IPs. Normalize them and check them in threat-intelligence tools.
5. Connect and detect
Link the family to campaigns and CVEs it exploits, then translate behavior into detection ideas (e.g., network or host indicators) and record everything in an investigation.
Tools that help
- Hash Checker — identify and check hashes.
- IOC Lookup — normalize and check indicators.
- Investigation Workspace — record findings and next steps.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.