1. Perform static analysis (strings, PE headers, imports).
2. Deobfuscate code using techniques like replacing `eval` with `echo`.
3. Analyze network traffic (PCAP) for C2 patterns.
4. Extract and decrypt configuration data.
5. Identify encryption algorithms and keys.
6. Analyze .NET or PowerShell code using dnSpy or PowerShell tools.
7. Document findings and indicators of compromise.
SynapticSkills