When you reverse engineer code as part of an incident response team, you want to quickly get information about what kind of threat you're dealing with.
A while back we released Intezer Analyze plugins both for IDA Pro and Ghidra to help you zero in on a file’s malicious and unique code. Now it is Radare's turn. Radare2 (r2) is an open-source tool chain for reverse engineering and forensics. With the release of the community plugin r2analyze, r2 users can now supercharge their reversing session with code genomics from Intezer to attribute the malware family or threat actor.
The Radare Plugin for Reverse Engineering
How to get started:
- Make sure you have an Intezer Analyze community account, or a paid team account. (If not, register here.)
- Submit the file to Intezer Analyze.
- Install the plugin via pip:
pip install r2analyze. - Add your API key as an environment variable named INTEZER_API_KEY.
- Open the file in r2 and perform an initial analysis (aaa).
- Run the plugin as a r2pipe command (
#!pipe r2analyze).
Here is an example using a ScarCruft sample (7c82689142a415b0a34553478e445988980f48705735939d6d33c17e4e8dac94). The result from Intezer Analyze is shown below.
If you open the sample and run the plugin, you can see below that four items in the flag space called gene have been created.
If selecting only that flag space and listing all the flags, you can see that four functions have been identified as unique to ScarCruft.
If Radare2 is your preferred framework for reverse-engineering and analyzing binaries, now you can use this Intezer Analyze plugin to save time and get additional insights for your incident response team.
Intezer automates the malware analysis process to quickly identify and classify malware families. Analyze malware and unknown files for free at analyze.intezer.com
Additional Resources
Joakim Kennedy
Dr. Joakim Kennedy is a security researcher at Intezer, analyzing malware and tracking threat actors on a daily basis. For the last few years, Joakim has been researching malware written in Go. To make the analysis easier he has written the Go Reverse Engineering Toolkit (github.com/goretk), an open-source toolkit for analysis of Go binaries.
In this article
Share article
Related Articles
.svg)
Alert Triage
AI SOC
3 min
We let a fruit fly brain triage 12,716 real SOC Alerts. Here is what happened.
On behalf of people who run SOCs, we explore how a fly brain triages alerts compared with a boring linear model you could train in eleven seconds.
.png)
AI SOC
4 min
The impact of the AI SOC: Intezer joins the Cybersecurity Awesomeness Podcast
Intezer's Field CISO and CMO join the Cybersecurity Awesomeness Podcast to explain what the AI SOC is, how it cuts false positives, and why analysts end up more empowered.
.svg)
AI SOC
CISO
MDR
4 min
Financial services need to rethink the MDR model
MDR providers investigate only about 40% of alerts. Learn why financial institutions are rethinking MDR renewals and what full alert coverage requires in 2026.
