Description
Many malware analysts perform reverse engineering on malware without knowing the why’s. They only know the how’s. To fill that knowledge gap, I have created this course.
You will learn first-hand from a Malware Developers’ perspective what windows API functions are commonly used in malware and finally understand why you need to trace them when reversing malware.
Learning Methodology:
Build programs that simulate Windows Trojans and Reverse Engineer them.
This will make you a better Reverse Engineer and Malware Analyst and also Penetration Tester.
The best way to understand malware is to be a Malware Developer.
Features:
Every topic will contain two parts: programming and reversing.
In the programming parts we will be writing programs that simulate trojan behavior by using API functions typically found in malware.
Then, in the reversing part, we take the programs that we wrote and perform reverse engineering on it
In this way, you will, for the first time, really understand why malware analyst do what they do when reversing a piece of malware
What you will learn:
How to compile and build executables and dynamic link libraries (DLL)
Windows API used in Malware
Creating shellcode using Metasploit on Kali Linux
Hiding shellcode payload in executable files
How to analyze and inspect memory of a running malware
Injecting Shellcode into running processes
Creating Remote Threads
Encryption of Payloads and Function Call String Parameters
Obfuscation of Function Calls
Malware Stealth Strategies
Encoding of Payloads
Trojan Development Life Cycle
How Anti Virus works under the hood
Using Yara to study malware signatures
Anti Virus Evasion Techniques
Dynamic Runtime API Loading