Every sample tells a story. We read it.
When malware turns up on a client network or in the wild, SkyHelm's researchers take it apart: what it does, how it spreads, how it talks home and how to find it everywhere else.
From quarantine to detection.
Every step happens in isolation, so the malware never gets a chance to run anywhere it could do harm.
Collect it safely
Samples come from endpoint quarantine, incident response work and threat intelligence, collected without risk to the network they came from.
Watch it run in isolation
In an isolated sandbox, we watch what it does: files it drops, settings it changes, processes it starts and the addresses it tries to reach.
Look inside when watching isn't enough
Unpack it, decode its configuration and pull out its command-and-control details, including behavior designed to hide from sandboxes.
Pull out every indicator
File hashes, domains, IP addresses and the behaviors that give it away, even after the attacker changes the file.
Turn it into protection
Behavior-based detections and hunting queries go to our SOC, and indicators go into TITAN, so the next appearance is caught on sight.
Find it everywhere else
We search the endpoint and network history we already have for the same malware, so one discovery can protect every network we watch.
From a single endpoint alert.
Most samples start as a threat caught on one endpoint, with its process tree, file details and response actions recorded in TITAN.
The malware that matters.
Ransomware and loaders
The encryptors, and the loaders that deliver them, which often arrive days before the ransom note.
Credential stealers
Infostealers that harvest passwords and session cookies, the source of many dark web credential leaks.
Backdoors and remote access trojans
Tools that give attackers a way back in, and the persistence tricks that keep them there.
Living-off-the-land attacks
Attacks that abuse legitimate admin tools like PowerShell and remote management software instead of dropping obvious malware.
Malicious documents and scripts
Weaponized attachments, macros and scripts used to get the first foothold.
OT-targeting malware
Malware built to understand or interfere with industrial control systems and their protocols.
The answers that drive decisions.
In the middle of an incident, malware analysis isn't academic. It tells the response team what the attacker could reach and what to check next, so containment and recovery decisions rest on facts.
- Is it still talking to the attacker?
- What data could it reach, and could it send it out?
- Did it bring a second payload or a way back in?
- Which other machines show the same signs?
- Is it safe to restore from this backup?
Where malware research shows up.
See what our researchers would find.
Talk to us about how SkyHelm's malware research feeds our SOC and TITAN, and what it means for your endpoints.