"Companies don't need malware analysis.
They can just send a sample to an antivirus company
and they will cover it for them."
I got this comment from someone and,
it's actually not really true.
So here's the thing, when you send the sample
to an antivirus company, they wouldn't analyze it for you.
They will actually do include in there
a signature and that's it.
They may update the signature but
that doesn't cover everything related to the malware.
The thing here is that, not only that you will not know
what are the domains to cover and what what are all
the other different IoCs that you can detect
and fit in machines with.
You also send them one sample from your machine.
You don't know if there's any other samples
that are actually part of that malware.
Maybe a dropper, maybe a downloader
that's reading other machines as well.
The second thing is that,
companies can actually do their analysis for you
if you pay for that.
It's a completely different package.
They can do the whole incident response process,
but that's a third package.
And companies would prefer to have that in-house
rather than paying for all of these companies,
every single time.
But even in some,
not only because it's money-wise it is better,
but also for them it is much better, as in time-wise
because until you send the sample and actually they react,
for a case like ransomware you might have,
the whole company has been encrypted
by the time when the antivirus company reacted.
And you need to have something that is fast
in timely manner that you can detect this malware
and not only detect the malware and analyze it,
or understand what it does,
understand or collect at least the IoCs,
but also to know what are all the other,
what are all the other files have been dropped
by this malware have been used.
What is the root cause, how that happened
and how it came to this machine
and last, to be able to contain and remediate this attack.
And that means to know all the infected systems.
Where did this malware or even what one stage
of this malware is actually there and able
to remediate this attack.
And this is a bigger process than just analyzing the malware
Last thing is that malware analysis,
the knowledge that you learn with malware analysis,
is the core fundamentals
of learning any part of cybersecurity.
The reason is that malware analysis actually covers
how real attacks look like.
This is important for, offensive or defensive
for the defensive side.
There's actually a book that I was reading
that I was looking into like three days ago
and it's called Advanced Penetration Testing:
Hacking the World's Most Secure Networks
and what it talks about,
all the book's talking about is generating malware.
It's all that it talks about.
how to generate a spear phishing email,
how to generate different malware
and how you can escalate through the whole attack.
The real thing is that real attacks, real targeted attacks
what is happening in the world
and what is hacking the world's most secure networks
are all depending on malware.
All depending on the malware behavior, malware functionality
and specific techniques to escalate privilege
to do the lateral movements,
to maintain persistence and so on.
So, if you understand malware analysis
you understand how all these attacks happen.
This is the core knowledge that from there
you can go into whatever field you want.
For penetration testing, how it can simulate these attacks.
If you are in threat hunting, what type of techniques
or tactics I can predict and try to defend against it.
If I'm threat intelligence, then how I can use
IoCs to collect
and to track specific actors
that comes into shared code,
that comes into shared IoCs,
and that, lots of work is related to malware analysis
and how to respond to an attack which is
mainly built on
malware analysis and malware knowledge.
So, this is why malware analysis
is still very relevant to
lots of companies who want to protect themselves
and to people who want to find a job in that field.
Hope that this video is helpful for you
and see you in the next video.