
Welcome to this course. I am very excited to introduce you to this topic area!
In this short video I will describe some of the most important drivers for analyzing malware.
We will discuss the different components of malware analysis and how each contributes to the final understanding of the malware's behavior.
We will be using virtual machine technology to build out our analysis laboratory. In this video I will explain the primary components of the lab.
I will demonstrate how to download, install then configure the lab components.
Before analyzing any malware, let us first discuss how out lab is isolated and protected from accidental infection.
We will install and configure our Linux host for this course.
I will show you how to our Microsoft test image running on our machines in this video demonstration.
We will pull our lab together in this video and download all the final components required to start the analysis of a piece of malware.
I will share how to safely transport malware samples over the network.
An important part of the malware analysis is maintaining the sample during analysis. This will be very important should any part of your analysis need to be replicated.
Modern executable files are rich with internal data that is valuable to the malware analyst. You just have to know how to find and interpret the data.
Human readable strings of characters will often tell important details about the internal workings of an executable file.
We will recap the progress of our analysis after having completed these initial static analysis steps.
We can simulate an entire Internet of hosts using ApateDNS to redirect DNS requests to a host we control.
Process Explorer and Process Monitor are excellent tools to instrument a running system with in order to capture events happening within the system.
Windows APIs are as close to actual source code as we can get. With this tool we can observe the API calls, their inputs and their outputs.
We can judge how effective our analysis efforts have been by comparing our findings with the human readable source code of the malware.
There are many types of malicious software that are enabled by the wider use of the internet, portable media, mobile devices and embedded systems. This malicious software includes trojan horses, worms, viruses, botnets and spyware, ransomware and many more. In this course, students will be shown how to set up an analysis “laboratory” that will offer all the isolation and protection needed for safe dissection of malware, while being capable enough to deliver fast and accurate results.
After discussing the primary goals of malware analysis and offering a number of “pro-tips”, the instructor lays out a design for an analysis lab. Every step of building the lab is demonstrated in such a way as to enable and encourage students new to the field to be successful. Once the lab is operational, the process for dissecting malware samples is delivered in an interactive and hands-on manner, geared toward having the student complete the analysis within their own lab concurrent with the lesson being taught.
Even though the course lessons are demonstrated in a Microsoft Windows environment, users familiar with both Apple MacOS and Linux will be able to follow along as all the software in use available for all three platforms and at no cost.
Once the technique and tools used for malware analysis have been taught, malware samples are provided to the student for additional practice.