A Malware Analysis Report (MAR) is a document that provides an in-depth breakdown about the functionality and risk of a new or evolving cyber threat. Typically, a MAR categorizes the malicious intent of a given piece of malware by how the code executes and what it was designed to steal. The documentation also lets readers know how to recognize signs of infection and how to mitigate risk.
The National Cyber Awareness System, which is run by the U.S. Department of Homeland Security, disseminates Malware Analysis Reports in alerts, RSS feeds and opt-in newsletters. A typical MAR includes the following information:
- Summary -- explains who did the research.
- Findings -- describes what the malware is designed to do.
- Recommendations -- provides best practices for preventing infections and recovering from them.
A Malware Analysis Report (MAR) provides organizations with detailed analysis of a specific threat by manually reverse engineering the malicious code. First, the static properties of malware -- including header information, hashes, embedded strings and resources are often collected to provide researchers with compromise indicators. Next, the behavior of the malware will be observed and finally, engineers will manually try to reverse the code to understand how it works.
Generally, MARs are created by dedicated research teams, either in law enforcement, academia or security enterprises. For example, the United States Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) recently issued a joint malware analysis report on a new Trojan horse called HOPLIGHT. HOPLIGHT is a backdoor Trojan that has reportedly been used by an advanced persistent threat (APT) group in North Korea called Lazarus. The malware can read, write and move files. It can also create and kill processes and services, edit registry settings and upload or download files to (and from) a remote server.