Abstract

This class is planned, designed and organized to introduce students to professional techniques and advanced concepts for analyzing malware threats from different perspectives and requirements.

We will present a detailed approach and a wide range of techniques on how to analyze daily malware threats, starting by building an appropriate infrastructure for analysis. Core topics such as Windows Internals concepts, IDA Pro and debuggers will be refreshed for attendees as well as a different sandbox configuration will be demonstrated. We review a few unpacking examples to allow students to refresh key concepts. Afterwards, the course offers a controlled chapter including main anti-analysis techniques, which provide analysts with necessary information to bypass and handle such techniques. The next chapter is also completely practical by presenting reverse engineering and analysis techniques to manage pieces of code involving PE, COM and networking communication.

The second part of the course increase the level of difficult by entering into a challenging stuff like string decryption and API hashing. We proceed to another very interesting stuff that is C2 configuration extraction, which is composed by dynamic and static techniques. The emulation and IDA snapshot section is briefly explained and demonstrated. Finally, the next part of the training starts by introducing concepts about .NET concepts, unpacking and, of course, malware analysis. Finally, an extensive chapter covering shellcode reversing that offers a valuable perspective about the topic. At the end, foundations and practical techniques on malware analysis of Golang binaries are explained.

This class will focus on x86/x64 Windows operating system, and eventually students will be using Linux system for supporting the analysis.

Who Should Attend

This class should be attended by professionals interested in learning elaborated techniques to analyze malware threats. Attendees coming from incident response, threat hunting and even an introductory malware analysis course will benefit from this course because it offers a huge amount of information and practical techniques to analyze current and modern threats.

This a challenging and demanding course, and students should be prepared.

Key Learning Objectives

Students attending this class will:

  • Learn how to setup an appropriate laboratory for daily analysis.
  • Refresh relevant concepts such as Windows Internals, IDA Pro, Debugging and unpacking procedures.
  • Understand how to handle with anti-analysts techniques.
  • Master API hashing and string decryption.
  • Learn how to extract C2 configuration through static and dynamic analysis.
  • Learn how to use emulation and IDA snapshot.
  • Learn how to analysis .NET malware.
  • Apply and learn practical techniques to analyze shellcodes.
  • Learn how to manage reverting malware threats in Go, Dephi, Rust and Nim.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Knowledge about fundamental static and dynamic analysis.
  • IDA Pro or equivalent disassembler/decompiler.
  • Local and remote debugging.
  • Basic unpacking.
  • Malware analysis foundation.
  • Prior experience on Python programming.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • One virtual machine running Ubuntu 22.04+ or REMnux.
  • Two virtual machines running Windows 11.
  • One virtual machine running Windows 7.
  • Malwoverview installed on all virtual machines, including all necessary APIs already configured.
  • Visual Studio Code installed in both Windows 11 x64 virtual machines.
  • Visual Studio and SDK installed on both Windows machines.
  • Recent versions IDA Pro or IDA Free.
  • x64dbg installed in all Windows virtual machines.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class follows:

  • Section 01: Introduction
  • Section 02: Lab Setup
  • Section 03: WinDbg Review
  • Section 04: Windows Concepts Review
  • Section 05: IDA Pro Review and Plugins
  • Section 06: Debuggers Review
  • Section 07: Unpacking Native Binaries
  • Section 08: Anti-Analysis | COM | NET
    • SubSection 08.01: Anti-Disassembly
    • SubSection 08.02: Anti-Debugging
    • SubSection 08.03: Anti-VM
    • SubSection 08.04: Cryptography
    • SubSection 08.05: Maldev Notes
    • SubSection 08.06: COM
    • SubSection 08.07: Network
  • Section 09: Core Malware Analysis
  • Section 10: Shellcode Reversing
  • Section 11: IDA Snapshot and Emulation
  • Section 12: .Net Malware Analysis
  • Section 13: Reversing Notes
    • SubSection 13.01: Go Reversing
    • SubSection 13.02: Delphi Reversing
    • SubSection 13.03: Rust Reversing
    • SubSection 13.04: Nim Reversing

Note: Topics can be added, merged or removed without prior notice!