Browse Definitions :
Definition

Malware Analysis Report (MAR)

Contributor(s): Matthew Haughn

A Malware Analysis Report (MAR) is a document that provides an in-depth breakdown about the functionality and risk of a new or evolving cyber threat. Typically, a MAR categorizes the malicious intent of a given piece of malware by how the code executes and what it was designed to steal. The documentation also lets readers know how to recognize signs of infection and how to mitigate risk. 

The National Cyber Awareness System, which is run by the U.S. Department of Homeland Security, disseminates Malware Analysis Reports in alerts, RSS feeds and opt-in newsletters. A typical MAR includes the following information: 

  • Summary -- explains who did the research.
  • Findings -- describes what the malware is designed to do.
  • Recommendations -- provides best practices for preventing infections and recovering from them.

A Malware Analysis Report (MAR) provides organizations with detailed analysis of a specific threat by manually reverse engineering the malicious code. First, the static properties of malware -- including header information, hashes, embedded strings and resources are often collected to provide researchers with compromise indicators. Next, the behavior of the malware will be observed and finally, engineers will manually try to reverse the code to understand how it works.

Generally, MARs are created by dedicated research teams, either in law enforcement, academia or security enterprises. For example, the United States Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) recently issued a joint malware analysis report on a new Trojan horse called HOPLIGHT. HOPLIGHT is a backdoor Trojan that has reportedly been used by an advanced persistent threat (APT) group in North Korea called Lazarus. The malware can read, write and move files. It can also create and kill processes and services, edit registry settings and upload or download files to (and from) a remote server. 

This was last updated in December 2019

Continue Reading About Malware Analysis Report (MAR)

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • data governance policy

    A data governance policy is a documented set of guidelines for ensuring that an organization's data and information assets are ...

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance as a service (CaaS)

    Compliance as a Service (CaaS) is a cloud service service level agreement (SLA) that specified how a managed service provider (...

SearchSecurity

  • Advanced Encryption Standard (AES)

    The Advanced Encryption Standard, or AES, is a symmetric block cipher chosen by the U.S. government to protect classified ...

  • intrusion detection system (IDS)

    An intrusion detection system (IDS) is a system that monitors network traffic for suspicious activity and alerts when such ...

  • Secure Shell (SSH)

    SSH, also known as Secure Shell or Secure Socket Shell, is a network protocol that gives users, particularly system ...

SearchHealthIT

SearchDisasterRecovery

SearchStorage

  • cache memory

    Cache memory, also called CPU memory, is high-speed static random access memory (SRAM) that a computer microprocessor can access ...

  • capacity management

    Capacity management is the broad term describing a variety of IT monitoring, administration and planning actions that are taken ...

  • cloud storage

    Cloud storage is a service model in which data is transmitted and stored on remote storage systems, where it is maintained, ...

Close