- [Narrator] Malware analysis is the study
or process of determining the functionality origin
and potential impact of a given malware sample,
such as a virus, worm, Trojan horse, rootkit, or backdoor.
Cisco acquired a security company called Threat Grid
that provides cloud-based
and on-premises malware analysis solutions.
Cisco integrated the Cisco AMP and Threat Grid
to provide a solution for advanced malware analysis
with deep threat analytics.
The Cisco AMP Threat Grid integrated solution
analyzes millions of files and correlates them
with hundreds of millions of malware samples.
This provides a look into attack campaigns
and how malware is distributed.
This solution provides a security administrator
with detailed reports of indicators of compromise
and threat scores that help prioritize mitigations
and recover from attacks.
Cisco AMP Threat Grid crowd sources malware
from a closed community and analyzes all samples
using highly secure proprietary techniques
that includes static and dynamic analysis.
These are different
from traditional sandboxing technologies
used in malware analysis.
The Cisco AMP Threat Grid analysis exists
outside the virtual environment,
identifying malicious code designed to evade analysis.
There is a feature in Cisco AMP Threat Grid
called Glove Box that helps you interact
with the malware in real time.
Recording all activity for future playback and reporting.
Advanced malware uses numerous evasion techniques
to determine whether it is being analyzed in a sandbox.
Some of these samples require user interaction.
Glove Box dissects these samples
without infecting your network,
while the samples are being analyzed.
Glove Box is a powerful tool against advanced malware
that allows analysts to open applications
and replicate a workflow process.
See how the malware behaves
and even reboot the virtual machine.
There are different boxes or sandbox implementations
for malware analysis.
The following are the most popular types.
Full system emulation,
which simulates the host's physical hardware
including the processor, CPU and memory
and operating system.
To allow you to obtain deep visibility into the behavior
and impact of the program being analyzed.
Emulation of operating systems,
which emulates the host operating system,
but not the hardware.
And virtualized,
which are VM based sandboxes to contain
and analyze suspicious programs.