Sigreturn Labs
Contact
We take malware apart, from A to Z, and tell you exactly what it is and what it does, scoped to what you actually need, whether that is detection, attribution, or recovery. With a dedicated ransomware practice that goes one step further: attempting to break the encryption and get your data back.
Two practices: general malware analysis, and a ransomware specialty.
Complete reverse engineering of a sample, end to end, from a fast triage to a full teardown. We adapt the depth to your goal: detection, threat intelligence, or incident support.
A dedicated ransomware practice. Full analysis and family attribution, and, where the cryptography allows, an attempt to build a working decryptor and recover your data.
The same four steps, whether the goal is detection, attribution, or a decryptor.
We agree on the sample(s), the goal (detection, intel, or decryption) and any constraints.
The sample is triaged and unpacked in an isolated, instrumented analysis lab.
Static and dynamic reverse engineering against the agreed goals, methodical and logged.
Findings and artefacts (rules, IOCs, and a decryptor where achieved) written up in full.
Everything we find, and how we found it, with the artefacts you can put straight to work.
Decryption is attempted, never promised. It depends on a genuine weakness in the ransomware's cryptography. We assess feasibility up front and tell you honestly before any work starts. Reverse engineering here targets the malware itself. Recovering data from disks or investigating how an intrusion happened is the Forensics service.
Send us the sample or the case, and we will tell you what we can establish and what is realistic.