First steps in ANY.RUN<\/h2>\n \n\n\n \n \n ![](\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/09\/guides_flag.jpg\")
\n Start here<\/h3>\n \n - \n How to\n use ANY.RUN Sandbox<\/a>\n <\/li>\n
- \n Threat Intelligence with ANY.RUN Lookup<\/a>\n <\/li>\n
- \n Setting up your\n team<\/a>\n <\/li>\n
- \n Tags and\n indicators<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
![](\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/09\/guides_glass.jpg\")
\n Intro to malware analysis<\/h3>\n \n - \n What is interactive\n analysis<\/a>\n <\/li>\n
- \n Basics of\n malware detection<\/a>\n <\/li>\n
- \n \n Retrospective analysis and detection<\/a>\n <\/li>\n
- \n \n ANY.RUN and Suricata<\/a>\n <\/li>\n
- \n Creating\n malware reports<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
ANY.RUN essentials<\/h2>\n \n\n\n \n \n ![](\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/09\/guides_flask.jpg\")
\n Extracting in-depth data<\/h3>\n \n - \n \n Collecting IOCs<\/a>\n <\/li>\n
- \n Examining process\n details<\/a>\n <\/li>\n
- \n Quick\n access to malware configs<\/a>\n <\/li>\n
- \n ATT&CK matrix\n in ANY.RUN<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
![](\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/09\/guides_user.jpg\")
\n Network tools<\/h3>\n \n - \n \n Analyzing the network stream<\/a>\n <\/li>\n
- \n MITM\n proxy<\/a>\n <\/li>\n
- \n Extracting data\n from open directories<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
Threat inteligence and real-word usage<\/h2>\n \n\n \n \n ![](\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/09\/guides_magnet.jpg\")
\n Collecting threat data<\/h3>\n \n - \n Finding linked indicators in ANY.RUN TI Lookup<\/a>\n <\/li>\n
- \n \n Tracking popular malware<\/a>\n <\/li>\n
- \n \n Downloading samples from our database<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
![](\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/09\/guides_lightbulb.jpg\")
\n Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
\n Start here<\/h3>\n \n - \n How to\n use ANY.RUN Sandbox<\/a>\n <\/li>\n
- \n Threat Intelligence with ANY.RUN Lookup<\/a>\n <\/li>\n
- \n Setting up your\n team<\/a>\n <\/li>\n
- \n Tags and\n indicators<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Intro to malware analysis<\/h3>\n \n - \n What is interactive\n analysis<\/a>\n <\/li>\n
- \n Basics of\n malware detection<\/a>\n <\/li>\n
- \n \n Retrospective analysis and detection<\/a>\n <\/li>\n
- \n \n ANY.RUN and Suricata<\/a>\n <\/li>\n
- \n Creating\n malware reports<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
ANY.RUN essentials<\/h2>\n \n\n\n \n \n \n Extracting in-depth data<\/h3>\n \n - \n \n Collecting IOCs<\/a>\n <\/li>\n
- \n Examining process\n details<\/a>\n <\/li>\n
- \n Quick\n access to malware configs<\/a>\n <\/li>\n
- \n ATT&CK matrix\n in ANY.RUN<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Network tools<\/h3>\n \n - \n \n Analyzing the network stream<\/a>\n <\/li>\n
- \n MITM\n proxy<\/a>\n <\/li>\n
- \n Extracting data\n from open directories<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
Threat inteligence and real-word usage<\/h2>\n \n\n \n \n \n Collecting threat data<\/h3>\n \n - \n Finding linked indicators in ANY.RUN TI Lookup<\/a>\n <\/li>\n
- \n \n Tracking popular malware<\/a>\n <\/li>\n
- \n \n Downloading samples from our database<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
\n \n Intro to malware analysis<\/h3>\n
\n Intro to malware analysis<\/h3>\n \n - \n What is interactive\n analysis<\/a>\n <\/li>\n
- \n Basics of\n malware detection<\/a>\n <\/li>\n
- \n \n Retrospective analysis and detection<\/a>\n <\/li>\n
- \n \n ANY.RUN and Suricata<\/a>\n <\/li>\n
- \n Creating\n malware reports<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
ANY.RUN essentials<\/h2>\n \n\n\n \n \n \n Extracting in-depth data<\/h3>\n \n - \n \n Collecting IOCs<\/a>\n <\/li>\n
- \n Examining process\n details<\/a>\n <\/li>\n
- \n Quick\n access to malware configs<\/a>\n <\/li>\n
- \n ATT&CK matrix\n in ANY.RUN<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Network tools<\/h3>\n \n - \n \n Analyzing the network stream<\/a>\n <\/li>\n
- \n MITM\n proxy<\/a>\n <\/li>\n
- \n Extracting data\n from open directories<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
Threat inteligence and real-word usage<\/h2>\n \n\n \n \n \n Collecting threat data<\/h3>\n \n - \n Finding linked indicators in ANY.RUN TI Lookup<\/a>\n <\/li>\n
- \n \n Tracking popular malware<\/a>\n <\/li>\n
- \n \n Downloading samples from our database<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
ANY.RUN essentials<\/h2>\n \n\n\n \n \n \n Extracting in-depth data<\/h3>\n \n - \n \n Collecting IOCs<\/a>\n <\/li>\n
- \n Examining process\n details<\/a>\n <\/li>\n
- \n Quick\n access to malware configs<\/a>\n <\/li>\n
- \n ATT&CK matrix\n in ANY.RUN<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Network tools<\/h3>\n \n - \n \n Analyzing the network stream<\/a>\n <\/li>\n
- \n MITM\n proxy<\/a>\n <\/li>\n
- \n Extracting data\n from open directories<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
Threat inteligence and real-word usage<\/h2>\n \n\n \n \n \n Collecting threat data<\/h3>\n \n - \n Finding linked indicators in ANY.RUN TI Lookup<\/a>\n <\/li>\n
- \n \n Tracking popular malware<\/a>\n <\/li>\n
- \n \n Downloading samples from our database<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
\n Extracting in-depth data<\/h3>\n \n - \n \n Collecting IOCs<\/a>\n <\/li>\n
- \n Examining process\n details<\/a>\n <\/li>\n
- \n Quick\n access to malware configs<\/a>\n <\/li>\n
- \n ATT&CK matrix\n in ANY.RUN<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Network tools<\/h3>\n \n - \n \n Analyzing the network stream<\/a>\n <\/li>\n
- \n MITM\n proxy<\/a>\n <\/li>\n
- \n Extracting data\n from open directories<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
Threat inteligence and real-word usage<\/h2>\n \n\n \n \n \n Collecting threat data<\/h3>\n \n - \n Finding linked indicators in ANY.RUN TI Lookup<\/a>\n <\/li>\n
- \n \n Tracking popular malware<\/a>\n <\/li>\n
- \n \n Downloading samples from our database<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
\n \n Network tools<\/h3>\n
\n Network tools<\/h3>\n \n - \n \n Analyzing the network stream<\/a>\n <\/li>\n
- \n MITM\n proxy<\/a>\n <\/li>\n
- \n Extracting data\n from open directories<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n
Threat inteligence and real-word usage<\/h2>\n \n\n \n \n \n Collecting threat data<\/h3>\n \n - \n Finding linked indicators in ANY.RUN TI Lookup<\/a>\n <\/li>\n
- \n \n Tracking popular malware<\/a>\n <\/li>\n
- \n \n Downloading samples from our database<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
Threat inteligence and real-word usage<\/h2>\n \n\n \n \n \n Collecting threat data<\/h3>\n \n - \n Finding linked indicators in ANY.RUN TI Lookup<\/a>\n <\/li>\n
- \n \n Tracking popular malware<\/a>\n <\/li>\n
- \n \n Downloading samples from our database<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
\n Collecting threat data<\/h3>\n \n - \n Finding linked indicators in ANY.RUN TI Lookup<\/a>\n <\/li>\n
- \n \n Tracking popular malware<\/a>\n <\/li>\n
- \n \n Downloading samples from our database<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n \n
Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
\n \n Applying your knowledge<\/h3>\n
\n Applying your knowledge<\/h3>\n \n - \n \n Analyzing IcedID<\/a>\n <\/li>\n
- \n How we\n solved 3 malware cases with ANY.RUN<\/a>\n <\/li>\n
- \n Using a sandbox for incident\n response<\/a>\n <\/li>\n <\/ul>\n <\/div>\n \n\n \n \n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n
\n
Didn’t find what you were looking for? Reach out to our friendly support team<\/p>\n\n Get help<\/a>\n <\/div>\n \n\n<\/div>\n\n\n\n