Browse Definitions :
Definition

Malware Analysis Report (MAR)

Contributor(s): Matthew Haughn

A Malware Analysis Report (MAR) is a document that provides an in-depth breakdown about the functionality and risk of a new or evolving cyber threat. Typically, a MAR categorizes the malicious intent of a given piece of malware by how the code executes and what it was designed to steal. The documentation also lets readers know how to recognize signs of infection and how to mitigate risk. 

The National Cyber Awareness System, which is run by the U.S. Department of Homeland Security, disseminates Malware Analysis Reports in alerts, RSS feeds and opt-in newsletters. A typical MAR includes the following information: 

  • Summary -- explains who did the research.
  • Findings -- describes what the malware is designed to do.
  • Recommendations -- provides best practices for preventing infections and recovering from them.

A Malware Analysis Report (MAR) provides organizations with detailed analysis of a specific threat by manually reverse engineering the malicious code. First, the static properties of malware -- including header information, hashes, embedded strings and resources are often collected to provide researchers with compromise indicators. Next, the behavior of the malware will be observed and finally, engineers will manually try to reverse the code to understand how it works.

Generally, MARs are created by dedicated research teams, either in law enforcement, academia or security enterprises. For example, the United States Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) recently issued a joint malware analysis report on a new Trojan horse called HOPLIGHT. HOPLIGHT is a backdoor Trojan that has reportedly been used by an advanced persistent threat (APT) group in North Korea called Lazarus. The malware can read, write and move files. It can also create and kill processes and services, edit registry settings and upload or download files to (and from) a remote server. 

This was last updated in December 2019

Continue Reading About Malware Analysis Report (MAR)

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

File Extensions and File Formats

SearchCompliance

  • PCI DSS (Payment Card Industry Data Security Standard)

    The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to ...

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance framework

    A compliance framework is a structured set of guidelines that details an organization's processes for maintaining accordance with...

SearchSecurity

  • Trojan horse (computing)

    In computing, a Trojan horse is a program downloaded and installed on a computer that appears harmless, but is, in fact, ...

  • identity theft

    Identity theft, also known as identity fraud, is a crime in which an imposter obtains key pieces of personally identifiable ...

  • DNS over HTTPS (DoH)

    DNS over HTTPS (DoH) is a relatively new protocol that encrypts domain name system traffic by passing DNS queries through a ...

SearchHealthIT

  • telemedicine (telehealth)

    Telemedicine is the remote delivery of healthcare services, such as health assessments or consultations, over the ...

  • Project Nightingale

    Project Nightingale is a controversial partnership between Google and Ascension, the second largest health system in the United ...

  • medical practice management (MPM) software

    Medical practice management (MPM) software is a collection of computerized services used by healthcare professionals and ...

SearchDisasterRecovery

SearchStorage

  • M.2 SSD

    An M.2 SSD is a solid-state drive (SSD) that conforms to a computer industry specification and is used in internally mounted ...

  • kilobyte (KB or Kbyte)

    A kilobyte (KB or Kbyte) is a unit of measurement for computer memory or data storage used by mathematics and computer science ...

  • virtual memory

    Virtual memory is a memory management capability of an operating system (OS) that uses hardware and software to allow a computer ...

Close