Static Analysis

• A1000 v7.0.2 integrates the latest version of ReversingLabs’ industry leading static analysis engine TitaniumCore v4.1.0. This update delivers on the following outcomes for our users:
  • Machine learning model hardening against input fuzzing attacks
  • More YARA classification rules with broader coverage
  • Quality improvements through delivery of prioritized bug fixes
• URL Analysis workflows have been improved and enriched with partial analysis results now available for users, with clear visual representation on the A1000 UI. Partial analysis occurs where only part of the data is downloaded and analyzed due to the URL Maximum Download Size limit being met

Maintenance & Operations

• Quality improvements through a number of prioritized defect fixes, including refinement on hash searching and SNMP configuration persistence after the upgrade
• Security compliance updates in v7.0.2 include a number of updates for backend services

Dynamic and Network Analysis

• RL Cloud Sandbox:
  • For users sending files for static analysis, Historic Reports from past RL Cloud Sandbox analyses are now shown during processing on the Sample Summary page. This benefits users by providing immediate insights from the RL data corpus and offering richer investigations without spending additional RL Cloud Sandbox quota

Maintenance & Operations

• Quality improvements through a number of prioritized defect fixes, including removal of the default Submission time filter and better handling of automatic uploads to RL Cloud Sandbox via A1000 REST API

Static Analysis

• Sources Section enrichment with Top Level Containers and Network References, improving the triage process with additional metadata. Additionally, Sources section is further optimized with tabular view, decreasing the navigation time and improving overview of the data

Dynamic and Network Analysis

• RL Cloud Sandbox:
  • Download Report extracts all data from analysis and exports it in PDF or HTML format, enabling the shareability of dynamic reports to other internal and external parties that don’t have access to the A1000
  • Screenshots, PCAP and MemStrings download option, offering an advanced look into the behavior, network traffic and memory strings extracted during dynamic analysis

Workflows

• Search Workflow enhancements: Users can more efficiently search for samples and interesting data within the RL data corpus using dropdown filters and newly introduced local-only keywords. With an improved user interface and performance, Search is positioned as a central page for any investigation on A1000
• User roles and Permissions: Provides administrators more granularity for user access, offering customizable User Roles with permissions to access Submissions, YARA and YARA Publish sections. Additional permissions will be added with upcoming releases
• Sample Summary enhanced with a header containing most important data on top of each subsection of the analysis report, providing a better overview regardless of page location
• “Unknown (No Threats Found)” Classification renamed to a more streamlined term for samples that didn’t receive a classification

Maintenance & Operations

• Security compliance updates in v7.0 include a number of updates for backend services.
• Quality improvements through a number of prioritized defect fixes, including notifications if storage is running out of space