Exalyze

Exalyze is a platform build by malware analysts for malware analysts. We developped the features of the platform to help us during our incident response and threat hunting investigations. After many years of reverse engineering malwares as reversers, threat hunters, or incident responders we often faced several challenges: We don’t have enough time to reverse all the samples we find We often reverse a malware that has already been reversed by another analyst (sometimes a good paper is published but we still have to completely reanalyze the sample to find out where the functions mentioned are located) Sometimes we are analyzing a malware and another victim is also analysing the same… so we probably would have a better time discussing this malware together to have a better understanding of the attacker We identify a malicious executable and would like to know if a previous version of the sample exist We often would have needed a fast overview of a sample before analyzing it (Is it packed? Are there quick wins? …) Basicly we need to capitalize reverse information, share them (not juste full blown reports) to not re-reverse something already analyzed by other people and have a fast overview of what a sample seems like. Exalyze was created to help solve those objectives. This allows to: Fastly disassemble samples and perform a quick analysis Compare the code with ALL other samples submitted on the platform Generate Yara rule on a sample with low level of false positives while identifying interesting patterns