Scott Hanson
Associate Managing Director & Head of Global Security Operations
Cyber Risk
Secaucus
Malware Analysis and Reverse Engineering
Kroll’s Malware Analysis and Reverse Engineering team draws from decades of private and public-sector experience, across all industries, to deliver actionable findings through in-depth technical analysis of benign and malicious code.
Contact UsOur experts translate complex analytical findings into targeted deliverables for executive, legal, and technical stakeholders to provide insight into the nature and scope of any code-related event.
Through a tailored application of static and dynamic analysis, Kroll’s cyber experts examine files to enumerate malicious functionality and develop comprehensive tear-down reports.
Our Malware Analysis Capabilities
Malware Triage and Analysis
Source Code Security Review
Reverse Engineering and Expert Code Review
Proactive Tooling Development
Malware Triage and Analysis
Whether it's standalone analysis or as part of a broader investigation, our team rapidly assesses the underlying nature of a sample to understand the risk to data, systems, and networks.
- Identify notable attributes such as malware family, Command and Control IP addresses or domains, host and network forensic artifacts, persistence mechanisms, and other indicators of compromise.
- Apply industry-best techniques ranging from automated sandbox detonation and observation to low-level reverse engineering, disassembly, and decompilation.
- Provide actionable recommendations to inform investigative next steps.
Source Code Security Review
Our expertise in exploit development and malware reverse engineering offers a highly trained eye to analyze and test software in fully controlled environments and identify vulnerabilities or flaws that expose software to real-world risk.
- Identify potential vulnerabilities in codebases to mitigate malicious exploitation
- Perform static code examination and review
- Dynamically test code functionality using industry-best methodologies
- Apply automated fuzz-testing framework
Reverse Engineering and Expert Code Review
The complexity of modern software lies at the heart of many intellectual property and trade secrets disputes. In support of expert witness and litigation matters, our team applies reverse engineering principles to determine how code operates and to understand critical factors behind its development.
- Collect and review open-source information to include pertinent publicly available reporting, documentation, and projects
- Perform in-depth code analysis in support of legal assessments and arguments
- Produce detailed deliverables including declarations and supporting technical documentation for Legal and Technical audiences
- Provide deposition and expert witness testimony as required
Proactive Tooling Development
To keep up with the near-daily evolution of modern malware, our team supports proactive penetration testing by applying real-world attack methodologies in controlled settings to ensure your security posture is ready for the technical attacks of today and tomorrow.
- Develop or repurpose malicious toolkits and utilities for heightened proactive testing
- Customize existing capabilities to avoid detection
- Support penetration testing exercises with real-world, cutting-edge attack methodologies
Technical Foundation
Our malware analysis experts are highly knowledgeable in every major platform, including:
- Windows, Linux, MacOS, iOS, Android, RTOS
- Microsoft 365, Google Workspace, AWS, Azure
- x86, x64, ARM, C, Java, Python, Go
- Develop atomic and behavioral indicators fed directly into Kroll's detection and response service platforms
- Incorporate up-to-date malware trends and active campaign intelligence across Kroll's global teams
Investigative Value
Benefits of our malware analysis services include:
- Rapid triage to inform investigative next steps
- Large-scale code teardowns in support of detailed reporting and legal requirements
- Collaborative partner in identifying the impact of code in a wide variety of scenarios
- Services tailored to the needs of the customer and objectives of the exercise
Talk to a Kroll Expert
Kroll is ready to help, 24x7. Use the links on this page to explore our services further or speak to a Kroll expert today via our 24x7 cyber hotlines or our contact page.
Data Collection and Preservation
Improve investigations and reduce your potential for litigation and fines with the strict chain-of-custody protocol our experts follow at every stage of the data collection process.
Computer Forensics
Kroll's computer forensics experts ensure that no digital evidence is overlooked and assist at any stage of an investigation or litigation, regardless of the number or location of data sources.
24x7 Incident Response
Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.
Office 365 Security, Forensics and Incident Response
Digital forensic experts investigate hundreds of Office 365 incidents per year and help strengthen your security.
Malware and Advanced Persistent Threat Detection
Our expertise allows us to identify and analyze the scope and intent of advanced persistent threats to launch a targeted and effective response.
Business Email Compromise (BEC) Response and Investigation
In a business email compromise (BEC) attack, fast and decisive response can make a tremendous difference in limiting financial, reputational and litigation risk. With decades of experience investigating BEC scams across a variety of platforms and proprietary forensic tools, Kroll is your ultimate BEC response partner.
Digital Forensics Services
In the event of a security incident, Kroll’s digital forensics investigators can expertly help investigate and preserve data to help provide evidence and ensure business continuity.
News
Article List
Press Release
Kroll Appoints Dave Burg as Global Head of Cyber Risk to Bolster World-Leading Business
March 12, 2024
Press Release
Kroll Expands Cyber Partner Program with MSP Specialization
October 17, 2023
Press Release
Kroll Responder Named as Overall Leader in The KuppingerCole Leadership Compass for Managed Detection and Response Services
August 16, 2023
Press Release
Kroll Launches Detection and Response Maturity Model and Finds 91% of Businesses Overestimate Their Cyber Maturity, Increasing Their Vulnerability to Cyberattacks
September 26, 2023
Events
Article List
Cyber
State of Cyber Defense: Healthcare Edition
April 24, 2024|Online
A deep dive into the latest threats and vulnerabilities facing the health care sector along with gaps in detection and response impacting improvement efforts.
Cyber
Kroll at RSA Conference 2024
May 6 - 9, 2024|Conference
Join Kroll experts at the RSA Conference in San Francisco May 6-9, 2024. Stop by booth 2239 in the South Expo Hall to meet our team.
Threat Intelligence
Q1 2024 Cyber Threat Landscape Virtual Briefing
May 29, 2024|Online
Join the Q1 2024 Cyber Threat Landscape Virtual Briefing as Kroll’s cyber threat analysts outline notable trends and insights from our incident response intelligence.
Kroll is headquartered in New York with offices around the world.
55 East 52nd Street 17 Fl
New York NY 10055
Sign up to receive periodic news, reports, and invitations from Kroll.
Our privacy policy describes how your data will be processed.
© 2024 Kroll, LLC. All rights reserved.
Kroll is not affiliated with Kroll Bond Rating Agency,
Kroll OnTrack Inc. or their affiliated businesses. Read more.