Malware Reverse Engineering & Threat Analysis
Defensive analysis of a sample you encountered: what it does, what it touched, how it persists, what it talks to — turned into indicators and detection logic your team can deploy today.
Verified Solvex Specialist
Verified by SolvexDirect specialist contact for Solvex engagements
What this means. An authorized Solvex administrator registered and approved this exact public identity. What it does not. Solvex has not inspected the account on the platform, and this is not the platform's own verification.
Solvex specialists never ask for your passwords, recovery phrases, one-time codes, or payments to a personal account. Work, scope and invoices are agreed in writing through the official channels on this site.
Signed authorization required. This engagement is performed only against systems you own or are contractually authorized to have tested, under an agreed scope. See the responsible testing policy.
What's covered
- Static analysis: structure, packing, strings, imports and embedded resources
- Controlled dynamic analysis in an isolated sandbox
- Configuration and payload extraction where the sample permits
- Behavioural characterisation: execution chain and capabilities
- Persistence mechanism identification
- Network indicator extraction, including C2 patterns
- IOC package and detection-rule recommendations (YARA, Sigma)
- Containment and eradication guidance
What you receive
- Malware analysis report with capabilities and execution chain
- IOC package: hashes, domains, addresses, paths, registry keys, mutexes
- YARA and Sigma rules derived from the sample
- Persistence and eradication guidance
- Containment recommendations for your environment
- Executive summary of what this means for the business
Evidence and reporting
How the work is kept honest- Evidence, frozen at issuanceFindings tie to something observed. When the report is issued, the evidence behind it is frozen in the same transaction and cannot be edited afterwards.
- A signed reportAn Ed25519 signature covers both the report content and the delivered file. Alter a byte of either and verification fails.
- Signed scope firstTesting starts only after written scope and signed authorization for systems you own or are entitled to have tested.
Anyone holding a Solvex report can verify it publicly without seeing its contents.
Our boundaries
What this engagement does not do, stated before it starts.
- Strictly defensive — we do not develop, weaponise, obfuscate or improve malicious code
- No attribution claims beyond what the technical evidence supports
- Some samples resist full analysis (anti-analysis, missing C2, partial payloads); we report what we could not determine
- Decryption of ransomware-encrypted data is generally not possible and is never promised
How this engagement runs
- 01
Intake
Tell us the system, the goal and the constraints. If the work is not a good fit, we say so before anyone is invoiced.
- 02
Scope and authorization
Written scope and signed authorization before anything is touched. Security testing runs only against systems you own or are contractually entitled to have tested.
- 03
Investigation or build
Specialists matched to the work. Findings are proven by hand — scanner output is a lead, never a finding.
- 04
Evidence
Every finding ties to something observed. When a report is issued, its evidence is frozen in the same transaction, so what backed the report cannot change afterwards.
- 05
Delivery
A signed report: an Ed25519 signature over both the content and the file, with a short verification reference you can read down a phone.
- 06
Verification and retest
Anyone holding the report can verify it publicly without seeing its contents. Fixes are retested as part of the engagement — “fixed” means we confirmed it.
Questions we are asked
- How fast can you turn a sample around?
- Initial triage — family identification, obvious IOCs and immediate containment guidance — is usually same-day, because that is what stops the bleeding. Full analysis with configuration extraction and tailored detections takes longer, and we deliver the urgent part first rather than holding everything for one report.
- Can you tell us who attacked us?
- We can tell you what the sample resembles and which tooling or infrastructure it shares. Confident attribution to a named group generally requires intelligence we do not hold, and overstating it is how incident response goes wrong. We will give you the evidence and its limits.
- Can you decrypt our ransomware-encrypted files?
- Almost certainly not. Modern ransomware uses sound cryptography; recovery comes from backups, or occasionally from a published flaw or a seized key. We check whether a known decryptor exists and we never sell hope as a service.
Related services
DFIR & Forensics
24/7 Incident Response Retainer
When an incident hits, every minute counts — and you don't want to be finding a responder then. A retainer gives you a pre-agreed expert team on standby, guaranteed response times, and people who already know your environment.
DFIR & Forensics
Digital Forensics Investigation
When you need to know exactly what happened — and prove it — our forensic examiners recover and analyse digital evidence with rigorous chain of custody. Findings that stand up to scrutiny, whether for internal, regulatory or legal use.
Reverse Engineering
Authorized Software Reverse Engineering
Structured analysis of software you own or are authorized to examine — understanding an undocumented binary, an inherited system with no source, a protocol you must interoperate with, or the behaviour of a dependency you cannot audit any other way.