Most malicious code analysis is performed by a single analyst, some times with collaboration tools for sharing comments on code between two or more analysts.
In this video from Shmoocon 2013, Richard Harman teaches you how to set up a virtualized analysis environment that is suitable for solo analysis, training a classroom of students, passing an analysis VM between analysts, and a self-service analysis “session” playback of previous analysis sessions. All of this while not getting in your way, and making efficient use of RAM and disk space.
Richard Harman is an incident responder at SRA International's internal Security Operations Center, where he slings Perl code supporting incident response and performs analysis & reverse engineering of targeted attack malware samples.
If you're interested in the field of malware analysis, read our article on becoming a malware analyst with commentary from McAfee, Avast, Bitdefender, Kaspersky Lab, FortiGuard and Symantec.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.