Introduction to Malware Analysis

4 years ago 156

BOOK THIS SPACE FOR AD

ARTICLE AD

These are going to be questions that you want to answer when analysing malware, what you want to achieve essentially by performing malware analysis.

Does the file pose a threat to the org, specifically? I.e. does it check for specific infrastructure, services or files that only the org’s users would hold.

What ways to defend against this threat, can we carve out from the analysis/reverse engineering of this malware?

What are the files capabilities?

What are the key functions of the file?

What can we extract that will support lessons learnt, threat hunting and future detection? I.e. IOC’s, specific behaviour not seen before etc.

What does the file reveal about the adversary? You want to attribute the attack to a group/actor, is there anything specific to an actor i.e. certain coding methods, certain IP’s/infrastructure used, certain TTP’s used etc.

Don’t overthink the sampleTry to get a general understanding of the malware, rather than digging into why the attacker may have setup a function in a certain way, for example.

2. Keep an open mind

Your samples will react differently to different environments, either through configuration/compatibility or evasion/detection from the sample.If static analysis isn’t working, try dynamic.

3. Malware will constantly evolve, so should your analysis techniques/tools.

As its likely the techniques you employ will be from here aswell a well known books/resources, the malware authors will be aware and aim to avoid/evade these techniques you learn. Try to apply what you learn to develop your own techniques.

Watch: Hackersploit Malware Analysis boot camp ← Click

YouTube

Colin Hardy

MalwareAnalysisForHedgehogs

Kindred Security

CheerioLive

Danooct1 (His viewer made malware playlist is also quite funny to watch)

HackerSploit

SANS Digital Forensics and Incident Response

MalwareTech

Twitter

Malwaretech

Podcasts

Darknet Diaries

Cyber by Motherboard

Books

Introduction to malware analysis by Packt

Practical malware analysis by No Starch Press

Malware Data Science by No Starch Press

Hands on learning with Workshops

Malware Unicorn Workshops RE101 and RE102: From 0 to Reverse Engineering Crypto Algorithms used by common malware samples. The first workshop presents a good workflow that it’s helpful during any malware analysis task. The RE102 it’s a good hands on tutorial and step by step guide to dissect a malware and walk through some of the most common “Anti-” techniques used by malware writers.

https://github.com/RPISEC/Malware: Materials developed by RPISEC. It includes Lectures, Labs and Projects. As a Textbook it references ‘Practical Malware Analysis’, it also contains a list of further places where to continue to pick up more samples or challenges.

Challenges

Some anti virus companies will put out “Crack me’s” as a challenge for recruitment, you can openly download these and try them even if you don’t want to apply: https://join.eset.com/en

FireEye Flare-On challenges: https://www.flare-on.com

Read Entire Article