Malware Analysis for Your Business
Malware analysis services turn a suspicious file into a clear account of what it does and who it talks to. Omeiro uses IDA Pro and Ghidra to disassemble binaries, unpack custom payloads and pull out command-and-control addresses.
What malware analysis looks at
The main areas we check, by hand with tools as support. The exact scope depends on your package and is agreed in writing before work starts.
Alerts and logs
- Which logs are kept
- Alert rules
- Who gets alerted
What happened
- Timeline of events
- Affected systems
- Entry point
Clean-up
- Removing access
- Resetting secrets
- Restoring from backup
Next time
- Written response steps
- Contacts list
- Lessons learned
Checklist Based on common risks and good practice. The exact scope depends on your package and is agreed in writing before work starts.
What you get with malware analysis
Deep binary disassembly using IDA Pro and Ghidra. Unpacking custom adversary malware payloads, extracting command-and-control (C2) server addresses, and documenting execution chains.
Basic Package
1 device or malware sample analysed; report. 5-day delivery, 2 revisions.
Standard Package
Up to 3 devices / samples; timeline. 8-day delivery, 2 revisions.
Premium Package
Up to 8 devices / samples; legal-ready report. 12-day delivery, 2 revisions.
Clear brief first
We confirm what you need before work starts, so the scope is clear on both sides.
Revisions listed
Each package shows its revision rounds. A round is one list of changes sent together.
Yours once paid
Copyright of the final work passes to you once the order is paid in full.
Work starts only after the scope is agreed in writing and you confirm you own or control the systems involved.
How our malware analysis works
Receive safely
Samples are handled in an isolated environment, never on a live network.
Unpack and disassemble
Packers are removed and the code is read in IDA Pro or Ghidra.
Trace behaviour
We follow persistence, network calls and the C2 addresses it contacts.
Write it up
Findings go into a report with indicators you can load into your tools.
Malware analysis scope: the question you need answered
Malware analysis scope depends on the question you need answered. Triage asks what the sample is and how to detect it. Deeper work asks how it persists, what it talks to and what data it touched. Tell us the device types, operating system, when odd behaviour began and whether the system has been wiped. Preserving disk images and logs before cleanup matters, since reimaging destroys evidence that both analysis and any later legal steps depend on.
A common mistake is uploading a suspicious file to a public scanner, which can alert the attacker. Analysis in an isolated lab avoids that. A good malware analysis report covers behaviour, persistence mechanisms, network indicators, a timeline when several devices are involved and detection suggestions your team can load into existing tools. It supports incident response, insurers and counsel, and it pairs with memory forensics if the threat lived only in RAM.
In short
- Delivery in 5 to 12 days, by package.
- Fixed price, shown before you order.
- Incident responders who have a sample but no reverse engineer.
- Copyright yours after full payment.
Malware Analysis: common questions
How much does malware analysis cost?
Prices are fixed and shown by package on our Malware Analysis pricing page, so you see the full price before you order. You can also ask for a custom quote.
How long does malware reverse engineering take?
Delivery depends on the package: Basic 5-day delivery; Standard 8-day delivery; Premium 12-day delivery.
What is included in the Basic Package?
The Basic Package includes: 1 device or malware sample analysed; report. Higher packages add more scope, revisions and support.
Can I get a custom digital forensics package?
Yes. If none of the packages fits, use the custom package form on our pricing page to describe what you need, and our team sends you a fixed price.
Do I need to send the live malware?
Yes, a copy of the sample or a disk image is needed. We tell you how to package it safely.
Will the report list indicators of compromise?
Yes, extracted addresses and file markers are included so your team can search for them.
Can you remove the infection?
This service explains the malware. Cleanup is a separate task, for which Ransomware Recovery may help.
Is the legal-ready report suitable for court?
It is written with evidence handling in mind, but you should ask your counsel whether it meets your needs.
What tools are used for malware reverse engineering?
Disassemblers and decompilers such as IDA Pro and Ghidra, a debugger, and a sandbox to observe runtime behaviour. The mix depends on the sample, since packed or obfuscated code needs unpacking before it can be read.
Who owns the final work?
Copyright of the final work passes to you once the order is paid in full. Paid fonts, stock files or licences, if used, are licensed in your name.
Ready to start your malware analysis?
Compare the packages and pick the one that fits. Not sure which? Write to us and we will help you choose.