radare2

r2 -A <sample>

Opens a binary in radare2 with automatic analysis (-A), the reverse engineering framework for disassembling, exploring, and understanding the sample.

Run it when you need reverse engineering of the sample: r2 -A automatically analyzes the binary (functions, cross-references, strings) and opens the console — from there you disassemble (pdf), explore functions, follow references to C2 strings, and understand the malware's logic. It's the reference RE framework for malware analysis: the open source alternative to IDA/Ghidra for console work and automation (r2pipe, scripts). In the IR, radare2 is the tool when static analysis and the sandbox aren't enough: the function that builds the C2 URL, the obfuscation routine, the persistence mechanism — the attacker's code, understood.

Don't use it for triage: radare2 is a depth tool — for quick identification (packer, strings, imports) use DIE, strings, and peframe. The learning curve is real: r2's console is powerful and cryptic, and manual analysis of a complex sample takes hours — for GUI work, Ghidra (135) or IDA are more accessible. And watch out: static analysis has limits with obfuscated or packed code — unpack the sample first, and dynamic analysis (the sandbox) complements what static doesn't see. radare2 is the malware analyst's tool, not for triage.