## 1 Introduction  
'Stuxnet' was the first malware that received worldwide attention for being able of causing physical damage in an industrial infrastructure. However, there are also a significant number of other known malware that can be grouped together as a recent and particular phenomenon known as Advanced Persistent Threats (APT), that deserves separate attention from other kinds of malware. 'Flame', as a part of this group, belongs to a family of complex malware that also includes 'Stuxnet', 'Duqu', and 'Gauss'. It was intended to attack particular types of networks and infrastructures using different techniques to persist during long periods of time [1]. On the other hand, another complex malware that was deployed mainly in Eastern European and Central Asian countries was 'Red October'. It was intended to attack government organizations and diplomatic services. Its operation focuses on information exfiltration in order to improve the intelligence of attackers.  
WannaCry, Locky, etc. are other malware, called 'ransomware' and developed to steal money. Today there are many specimens of malware, as mentioned above, that use multiple attack techniques and vectors and are conducted stealthily to avoid detection, in order to retain unnoticed control over targeted systems for long periods of time [2]. On the other hand, in recent decades with the new educational technologies and the growth of the Massive Open Online Course (MOOCs) [3; 4; 5; 6; 7; 8] there are new opportunities for this kind of malware to 'catch' new objectives and personal data which can be really important.  
In this paper, we describe a new systematic approach or methodology of malware analysis and its evaluation (case studies) by applying it to two of the most complex and well-known malwares that have emerged so far: Red October and Flame. It provides a structured analysis process and the definition of the steps to be followed, the objectives to be achieved and the specific techniques and tools to be used. It proposes a four stages implementation in order to that will help the analyst to work securely to produce a repeatable and objective result, to cooperate with other analysts. In the end, using this method will provide a better understanding of the analyzed malware without forgetting the importance of using the right information in the right moment enhancing the analyst effectiveness.  
Regarding the toolset that is needed for any malware analysis, it must be confirmed that the proposed method is independent of any specific tool or technic allowing an easy and cost-effective adaptation to malware analyst resources. Main characteristics of the presented method to analyze malware are as follows:  
* It does not depend on the complexity of the malware to be analyze
* It is independent of the tools used making easier its adoption
* In enhances the importance of the malware classification as one of the first steps to be done
* It considers the integration of any existing information of the malware as an input for the analysis
* It defines a specific sequence for the analysis based on making the analysis of code, before the dynamic or behavioral analysis
* It includes a systematic feedback loop to retake the process when malware complexity requires to do it, as well as to improve the current analysis feeding previous stages with the obtained results of later ones  
The rest of this paper is structured as follows. Section 2 surveys our current knowledge on the types of malware analysis techniques and available tools. Then, Sections 3 and 4 discuss the design of a methodological framework to integrate such techniques in a coherent and systematic way. The detailed results of applying that method to the analysis of the malware Red October and Flame are provided in Section 5. Finally, conclusions and future research guidelines are included in Section 6.