Upload File

reversing malware analysis training part1 lab setup guide

  • Home
  • Technology
  • Reversing malware analysis training part1 lab setup guide
16
Part I – Lab Setup Guide Swapnil Pathak Amit Malik Reverse Engineering & Malware Analysis Training

Upload: cysinfo-cyber-security-community

Post on 09-Jan-2017

426 views

Category:

Technology


1 download

Report

TRANSCRIPT

Page 1: Reversing malware analysis training part1 lab setup guide

Part I – Lab Setup GuideSwapnil Pathak

Amit Malik

Reverse Engineering & Malware Analysis Training

Page 2: Reversing malware analysis training part1 lab setup guide

Disclaimer

The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer’s only and nothing to do with the company or the organization in which the trainer is currently working.

However in no circumstances neither the trainer nor Cysinfo is responsible for any damage or loss caused due to use or misuse of the information presented here.

Page 3: Reversing malware analysis training part1 lab setup guide

Acknowledgement

Special thanks to null & Garage4Hackers community for their extended

support and cooperation.

Thanks to all the trainers who have devoted their precious time and

countless hours to make it happen.

Page 4: Reversing malware analysis training part1 lab setup guide

Reversing & Malware Analysis Training

This presentation is part of our Reverse Engineering & Malware

Analysis Training program. Currently it is delivered only during our local

meet for FREE of cost.

For

Page 5: Reversing malware analysis training part1 lab setup guide

Who am I #1

Amit Malik (sometimes DouBle_Zer0,DZZ) Member SecurityXploded & Garage4Hackers

Security Researcher

RE, Exploit Analysis/Development, Malware Analysis

Email: [email protected]

Page 6: Reversing malware analysis training part1 lab setup guide

Who am I #2

Swapnil Pathak Member SecurityXploded

Security Researcher

RE, Malware Analysis, Network Security

Email: [email protected]

Page 7: Reversing malware analysis training part1 lab setup guide

Introduction This Guide is specific to our course

Although it will cover most of the tools and techniques for an

analysis environment

Our main focus is on the famous tools

Page 8: Reversing malware analysis training part1 lab setup guide

Virtualization Run multiple OS on the single hardware at the same time.

Advanced functionalities like Snapshot, Revert Back, pause etc.

Automation

Controlled environment

Page 9: Reversing malware analysis training part1 lab setup guide

Virtualization Tools VmWare (Commercial)

VirtualBox (Open Source – free)

Images – XpSp2, XpSp3

Page 10: Reversing malware analysis training part1 lab setup guide

VmWare Image

Page 11: Reversing malware analysis training part1 lab setup guide

VirtualBox Image

Page 12: Reversing malware analysis training part1 lab setup guide

Tools Development Compiler/IDE

◦ Dev C++ (Free) - preferred

◦ Microsoft Visual C++ (Commercial)

Assemblers

◦ MASM (Free) -preferred

◦ NASM (Free)

◦ Winasm (IDE) (Free)

Interpreters

◦ Python (Free)

Page 13: Reversing malware analysis training part1 lab setup guide

Tools Reverse Engg. Disassembler:

◦ IDA Pro (Download free version)

Debuggers

◦ Ollydbg

◦ Immunity Debugger

◦ Windbg

◦ Pydbg (optional)

Page 14: Reversing malware analysis training part1 lab setup guide

Tools Reverse Engg. Cont. PE file Format

◦ PEview, PEbrowse, LordPE, ImpRec, Peid, ExeScan

Process Related

◦ ProcMon, Process explorer

Network Related

◦ Wireshark, TcpDump, Tshark, TCPView

File, Registry Related

◦ Regshot, filemon, InstallwatchPro, CaptureBat

Page 15: Reversing malware analysis training part1 lab setup guide

Tools Reverse Engg. Cont. Misc.

◦ CFFExplorer, Notepad++, Dependency Walker, Sysinternal tools

If something additional is required then we will cover that in the

respective lecture

Page 16: Reversing malware analysis training part1 lab setup guide

Thank You !


Reversing and Decrypting the Communications of APT Malware (Etumbot)

Malwaremoutane.net/RMLL2013/day_1/linux_malware.pdf · Linux malware presentation @r00tbsd – Paul Rascagnères from Malware.lu Darkleech/Chapro Analysis – Reversing xor_decrypt_string

Reversing & Malware Analysis Training Part 7 - Unpacking UPX

Reversing & malware analysis training part 8 malware memory forensics

Reversing and decrypting the communications of HeartBeat Rat - Part1

Reversing malware analysis training part8 malware memory forensics

Amateur Malware Analysis - SecDSM...Amateur Malware Analysis Are you interested in reversing but don't know where to start? Think reversing is beyond your means? This talk will try

Reversing and Malware Analysis

© SERG Reverse Engineering (Reversing Malware) Reversing Malware [based on material from the textbook]

Reversing and decrypting communications of apt malware

Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Reversing and Malware Analysis Training Articles [2012] . cracking/Reversing... · Reversing and Malware Analysis Training Articles ... Step 1: Start with what you ... Reversing and

MyCERT-3-PST-HoneynetConf-Reversing Android Malware · Android Malware Technology & Innovation Malicious piece of codes. Infection methods: o Infecting legitimate apps - Mod app with

Reversing & malware analysis training part 4 assembly programming basics

Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]

Practical Reversing IV – Advanced Malware Analysis

Reversing malware analysis training part4 assembly programming basics

Reversing & malware analysis training part 5 reverse engineering tools basics

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Reversing & malware analysis training part 9 advanced malware analysis

Reversing Malware [based on material from the textbook]

Reversing malware analysis training part12 rootkitanalysis

Reversing the Inception APT malware | Blue Coat...Finally we can see it’s connecting to webdav.cloudme.com and cleartext credentials in following screenshot. Malware tries to communicate

Reversing malware analysis training part10 exploit development basics

Reversing & malware analysis training part 3 windows pe file format basics

Reversing Android Malware › hitbsecconf2011kul... · Reversing’Android’Malware’ • Reversing’Process’ *.class or *.dex class Dalvik disassembling *.java decompiling disassembling

Reversing & malware analysis training part 2 introduction to windows internals

Practical Reversing III – Malware Memory Forensics

Reversing & Malware Analysis Training Part 4 - Assembly Programming Basics

Advanced Malware Analysis Training Session 10 - (Part 1) Reversing & Decrypting Communications of HeartBeat RAT

Reversing malware analysis training part7 unpackingupx

Reversing & malware analysis training part 6 practical reversing (i)

Reversing Android Malware - Hack In The Box Security ...conference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Mahmud Ab... · Reversing Android Malware ... - Spyeye’s’fake’security’tool

Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis training part3 windows pefile formatbasics