Malware Triage & Intelligence
IntermediateLearn malware analysis for threat intelligence: triage a sample safely, recover its configuration and C2, and turn what you find into intelligence. Read sandbox reports and script loaders, handle Linux ELF files and malicious Office documents, write YARA rules that survive a rebuild, and pivot from a configuration to the operator's infrastructure. It is built for CTI analysts, not reverse engineers, and the first section is free.
The first 2 modules are free. Premium unlocks the rest of the path and the certificate.
Curriculum
44 steps across 5 sections. Sections unlock in order as you complete them.
- Getting a Sample, and a LabModule
- Static Triage of a Windows ExecutableModule
- First Light: Triage the AttachmentMission
- Reading a Sandbox ReportPremiumModule
- Scripts, Lures and Loader ChainsPremiumModule
- The Chain Has Three LinksPremiumMission
- Beyond Windows PEPremiumModule
- Just Enough Reverse EngineeringPremiumModule
- Configuration ExtractionPremiumModule
- Read the Key, Not the ConfigPremiumMission
- Relating SamplesPremiumModule
- Detection From AnalysisPremiumModule
- Same Toolchain, Different HandsPremiumMission
- Hunting and Tracking a FamilyPremiumModule
- Writing for the ReaderPremiumModule
- Sharing, Provenance and AI HelpPremiumModule
- Operation Velkross: Draw the MapPremiumMission
Ready to start Malware Triage & Intelligence?
Create a free account to open the remaining 10 steps and track every step you finish. The first 2 modules are free. Premium unlocks the rest of the path and the certificate.
- First 2 modules free
- Progress saved on every step
- Certificate with Premium
About this path
A sample lands on your desk: from an incident, from a sandbox, pulled off a repository by hash. The job is not to reverse engineer every instruction. It is to get the intelligence out safely and at the right depth, and to be honest about what the file proves and what it does not. A model can summarise a report, but it cannot tell you that the import table lists injection APIs the code never calls, that the one domain the sandbox flagged is a connectivity check and not the C2, or that a clean verdict only means the sample did not run during a three minute detonation.
This path is built on artifacts you work on. Every lesson puts a real thing in front of you, a hex dump, an import table, a FLOSS line, a process tree, a PowerShell layer, a decompiled loop, an extracted configuration, a YARA rule, and asks you to read it, compute a value from it or decide what to do next. The tool output is real: it comes from running pefile, FLOSS, capa, YARA-X, Ghidra, CyberChef, readelf and olevba on inert training samples we built to be safe to study. You never download or run a live sample.
The first section is free. It covers getting a sample without exposing the victim or tipping off the actor, standing up a throwaway lab, deciding how deep the question needs you to go, and triaging a Windows executable statically: its header, its imports as capability hints, its strings including the ones that hide, whether it is packed, and a capa report read for what it really says. The rest of the path moves into behaviour and delivery (a sandbox report, a delivery chain, and two samples that are not Windows executables at all: a Linux ELF and a macro-laden Office document), into the code (just enough Ghidra, and configuration extraction), from one sample to intelligence (relating samples, detections that survive a rebuild, hunting and tracking a family across takedowns), and finally into delivering it (writing for each reader, sharing in MISP and STIX, and using AI help on the output without handing it the sample).
Missions along the way hand you a fresh inert sample to work end to end, and the path closes on a capstone in the lab: from one sample you recover the C2, pivot through archived scan and registration records to the operator's wider infrastructure, and state the link with a confidence you can defend.
You should know the basics of threat intelligence first. If hashes, IOCs, ATT&CK, the Pyramid of Pain and TLP are new to you, start with the Cyber Threat Intelligence path.
What you will learn
Get a sample safely. Know what each source costs the victim and the investigation, handle a file so it cannot run, and stand up a lab you can throw away.
Triage a Windows executable without running it. Read the header, imports, strings and entropy and a capa report, and tell what each one does and does not prove.
Read a detonation critically. Tell C2 from decoys and connectivity checks, find persistence in a process tree, and know what a clean verdict misses.
Follow a delivery chain. Peel script layers in CyberChef, read shortcut and container metadata, and trace a loader down to its payload.
Triage beyond Windows. Read a Linux ELF's header, sections and dynamic symbols, and pull a payload URL out of an Office macro without opening the document.
Open a disassembler with a purpose. Find the logic from an API call, recognise encoding and crypto routines, and read a .NET sample's configuration.
Extract a configuration. Pull C2, keys and campaign IDs by hand and with a reproducible extractor, and resolve dead-drop C2 passively.
Turn one sample into intelligence. Relate samples with similarity hashes without overclaiming, write YARA that survives a rebuild, and track a family across takedowns.
Deliver it. Write for the SOC, IR and leadership, state each claim with its evidence, and share in MISP and STIX with the right handling.
Who this path is for
CTI analysts who want to use malware as an intelligence source, not just read other people's reports on it.
SOC and IR analysts who receive samples and need to say something useful about them quickly.
Detection engineers who want YARA and Sigma rules that hold up against the next build.
Analysts who finished the Cyber Threat Intelligence path and want the hands-on malware skills it assumes.
Guides for this path
- ClickFix, Explained: The Attack That Turns Users Into the PayloadThere is no exploit in a ClickFix attack. The victim runs the malware themselves, copying a command off a fake CAPTCHA or update page and pasting it into their own machine. In 2025, Microsoft attributed 47% of all initial access intrusions it tracked to this one technique. This guide breaks down how ClickFix works, dissects three real campaigns, and covers exactly how to detect and defend against it.
- Malware Command and Control (C2) ExplainedCommand and control (C2) is the communication channel a threat actor uses to remotely operate compromised systems. This guide breaks down how every major C2 method works, from HTTP beaconing and DNS tunneling to domain fronting, trusted-service abuse, and blockchain-based channels, along with the logic behind each technique and how defenders detect C2 traffic.
Frequently asked questions
It is getting intelligence out of a malicious file rather than taking it apart for its own sake: what the sample is, what it is configured to talk to, which family and operator it belongs to, and what your SOC should block and detect. You work at the depth the question needs and say what the file proves and what it does not. CTI Academy's Malware Triage & Intelligence path teaches it on inert samples built for the purpose.
Malware triage is the fast, safe first pass on a sample: confirm what kind of file it is, read its header, imports, strings and entropy, run capa, and decide what it probably does and whether it is worth going deeper. You do it statically, without running the file. The free first section of this path teaches it on a Windows executable.
No. It is malware analysis for intelligence. You learn just enough Ghidra to find the configuration and the logic that matter to CTI, not full reverse engineering. There is no assembly course, no exploit development and no unpacking of commercial protectors.
No. Every binary you study is an inert training sample we built to be safe: a real file that does nothing harmful and never connects anywhere. The tool output in the lessons comes from running the real tools on those samples. You never download, unzip or run a live sample.
Yes. One module goes beyond Windows executables. You triage a Linux ELF with readelf, find its high entropy section, decode a hidden C2 and learn to pivot with telfhash, then pull the payload URL out of a malicious Word document's macro with olevba without ever opening the file.
Free ones: pefile, FLOSS, capa, YARA-X, Ghidra, CyberChef, ssdeep, TLSH, readelf and olevba, plus MISP and STIX for sharing. Lessons name the current version and date for each, because these tools move fast.
Yes. You write YARA rules from what the analysis found, test them before you deploy them, and learn which strings and conditions survive the next rebuild. The same module turns the behaviour a sample shows into Sigma rules.
Yes. Missions hand you a fresh inert sample and a short brief from a CTI desk, and you work it end to end: hash it, triage it, recover its configuration and decide what to block. The path closes on a capstone in the CTI Academy VPN lab, where you pivot from one sample's C2 through archived scan and registration records to the operator's wider infrastructure.
A little. You will read and run short Python extractors and use CyberChef in the browser. Nothing beyond that. The computations in the questions can be done with a calculator or CyberChef in a couple of minutes.
It helps. This path assumes you know hashes, IOCs, MITRE ATT&CK, the Pyramid of Pain and TLP, and it builds on them rather than teaching them again. The Cyber Threat Intelligence path covers all of them and is free.
About nine hours. The 39 lessons take roughly seven, at around 11 minutes each, and the missions about two.
Yes. Completing every step of the path, all twelve modules and its missions, issues a CTI Academy certificate in your name. Each certificate carries a unique ID, and its QR code opens a public verification page, so an employer can confirm it without contacting us.
The whole first section is free: eight lessons on getting a sample, building a throwaway lab and statically triaging a Windows executable, plus the section's mission. The later sections need a premium subscription.