Interpreting the output report of a malware analysis tool can be extremely helpful when you're trying
to find the root cause of an attack amp threat grid and KOO-KOO sandbox are both tools that can be used
to analyze malware amp through that grid analyzes suspicious behavior in your network against more than
450 behavioral indicators and a malware knowledgebase sourced from around the world.
As a result Ampe threat group provides accurate context rich analytics into malware that can be delivered
as either a cloud based or Ancrum solution to help organizations understand what malware is doing or
attempting to do.
How large a threat it poses and how to defend against it.
Let's take a look at how to analyze a mill where analysis report using Ampe through grid.
I'm just going to pick a random file of the global list of files that have already been analyzed.
So as you can see there is all sorts of good info displayed in this report.
Behavioral indicators which is a list of all the suspicious activity found while running the file in
the sandbox environment network activity information can be used to see if the file triggered an external
see and see connections or scans to other devices on its network.
You can also see the processes that were active after the file was launched to help pinpoint what it
was trying to accomplish such as changing firewall rules on the machine it was installed on registry
changes and file system changes are both key pieces of information here I can see which registry entries
were modified as well as file system activity for both rad and modified content.
Taking the time to analyze files that have been involved in a security incident can not only help you
identify what the file was trying to do locally but it can also show you other places in the system
or network that could have been affected.