## Malware Analysis for Threat Intelligence\n\n### Why Analyze Malware?\n\nFor CTI, malware analysis helps:\n- Extract IOCs (hashes, C2 servers, mutexes)\n- Understand adversary capabilities\n- Identify malware families and campaigns\n- Develop detection signatures\n- Attribute attacks to threat actors\n\n### Types of Analysis\n\n| Type | Description | Speed | Depth |\n|------|-------------|-------|-------|\n| **Basic Static** | File properties, strings, hashes | Fast | Low |\n| **Advanced Static** | Disassembly, decompilation | Slow | High |\n| **Basic Dynamic** | Run in sandbox, observe behavior | Medium | Medium |\n| **Advanced Dynamic** | Debugging, memory analysis | Slow | High |\n\n### Analysis Workflow\n\n```\n1. Obtain sample safely\n   ↓\n2. Calculate hashes (MD5, SHA256)\n   ↓\n3. Check reputation (VT, MalwareBazaar)\n   ↓\n4. Basic static analysis\n   ↓\n5. Sandbox detonation\n   ↓\n6. Extract IOCs\n   ↓\n7. Document findings\n```\n\n### Safety First!\n\n⚠️ **Always analyze malware in isolated environments**\n- Use dedicated VMs (snapshot before, revert after)\n- Disable network or use isolated network\n- Never analyze on production systems\n- Use FlareVM or REMnux