Browse Definitions :
Definition

Malware Analysis Report (MAR)

Contributor(s): Matthew Haughn

A Malware Analysis Report (MAR) is a document that provides an in-depth breakdown about the functionality and risk of a new or evolving cyber threat. Typically, a MAR categorizes the malicious intent of a given piece of malware by how the code executes and what it was designed to steal. The documentation also lets readers know how to recognize signs of infection and how to mitigate risk. 

The National Cyber Awareness System, which is run by the U.S. Department of Homeland Security, disseminates Malware Analysis Reports in alerts, RSS feeds and opt-in newsletters. A typical MAR includes the following information: 

  • Summary -- explains who did the research.
  • Findings -- describes what the malware is designed to do.
  • Recommendations -- provides best practices for preventing infections and recovering from them.

A Malware Analysis Report (MAR) provides organizations with detailed analysis of a specific threat by manually reverse engineering the malicious code. First, the static properties of malware -- including header information, hashes, embedded strings and resources are often collected to provide researchers with compromise indicators. Next, the behavior of the malware will be observed and finally, engineers will manually try to reverse the code to understand how it works.

Generally, MARs are created by dedicated research teams, either in law enforcement, academia or security enterprises. For example, the United States Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) recently issued a joint malware analysis report on a new Trojan horse called HOPLIGHT. HOPLIGHT is a backdoor Trojan that has reportedly been used by an advanced persistent threat (APT) group in North Korea called Lazarus. The malware can read, write and move files. It can also create and kill processes and services, edit registry settings and upload or download files to (and from) a remote server. 

This was last updated in December 2019

Continue Reading About Malware Analysis Report (MAR)

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • regulatory compliance

    Regulatory compliance is an organization's adherence to laws, regulations, guidelines and specifications relevant to its business...

  • privacy compliance

    Privacy compliance is a company's accordance with established personal information protection guidelines, specifications or ...

  • data governance policy

    A data governance policy is a documented set of guidelines for ensuring that an organization's data and information assets are ...

SearchSecurity

  • asymmetric cryptography (public key cryptography)

    Asymmetric cryptography, also known as public-key cryptography, is a process that uses a pair of related keys -- one public key ...

  • Evil Corp

    Evil Corp is an international cybercrime network that uses malicious software to steal money from its victims' bank accounts.

  • Plundervolt

    Plundervolt is a method of hacking that involves depriving an Intel chip of power so that processing errors occur.

SearchHealthIT

  • telemedicine (telehealth)

    Telemedicine is the remote delivery of healthcare services, such as health assessments or consultations, over the ...

  • Project Nightingale

    Project Nightingale is a controversial partnership between Google and Ascension, the second largest health system in the United ...

  • medical practice management (MPM) software

    Medical practice management (MPM) software is a collection of computerized services used by healthcare professionals and ...

SearchDisasterRecovery

SearchStorage

  • 3D NAND flash

    3D NAND is a type of non-volatile flash memory in which the memory cells are stacked vertically in multiple layers.

  • M.2 SSD

    An M.2 SSD is a solid-state drive (SSD) that conforms to a computer industry specification written for internally mounted storage...

  • RAID (redundant array of independent disks)

    RAID (redundant array of independent disks) is a way of storing the same data in different places on multiple hard disks or ...

Close