Reference Guide to Reverse Engineering & Malware Analysis Training

Powered by XenArmor

Reference Guide - Malware Analysis Training Series

Here is the complete reference guide to all sessions of our Reverse Engineering/Malware Analysis & Advanced Malware Analysis Training program.

Adv Malware Analysis Training Session 6 - Sandbox Analysis

CWSandbox :: Behavior-based Malware Analysis System Cuckoo Sandbox - Open source automated malware analysis Capture BAT - Malware behavioral analysis tool INetSim - Software for Network Behaviour Analysis of Malwares Anubis: Online Malware Analysis Service

Adv Malware Analysis Training Session 5 - Reversing Automation

IDAPython in a Nutshell API Call Tracing - PEfile, PyDbg and IDAPython pefile - Python module for PE (Portable Executable) Files Book: Grey Hat Python Malpimp - Malpimp - Advanced API Tracing Tool

Adv Malware Analysis Training Session 4 - Anti-Analysis Techniques

The Ultimate Anti-Debugging Reference Anti-Debugging – A Developers View Anti-Debugging with Exceptions AntiRE – An executable collection of Anti-Reversing Techniques

Adv Malware Analysis Training Session 3 - Botnet Analysis Part I I

Dynamic Taint Analysis and forward Symbolic Execution Taint Checking - Introduction Dytan: A Generic Dynamic Taint Analysis Framework Valgrind - Framework for building dynamic analysis tools Taint Analysis for Automatic Malware Detection TTAnalyze: A Tool for Analyzing Malware JACKSTRAWS: Picking C & C Connections from Bot Traffic BackTracking Intrusion

Adv Malware Analysis Training Session 2 - Botnet Analysis Part I

About Botnet - History, Attacks & Countermeasures Windows Asynchronous Procedure Calls About Waledac Botnet - http://en.wikipedia.org/wiki/Waledac_botnet Demo Video - Waledac Botnet Analysis - https://vimeo.com/57755964

Adv Malware Analysis Training Session 1 - Detection & Removal of Malwares

GMER - Anti-rootkit Tool http://www.gmer.net/ SpyDLLRemover - Tool to Remove Malicious DLLs from Process http://bit.ly/csujQX SpyBHORemover - Tool to Remove Malicious BHOs from Process http://bit.ly/1zGRN VirusTotal Scanner - Desktop Tool for Quick Anti-virus Scan http://bit.ly/Lir4Qz TCPView - http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx AutoRuns - Manage Startup Entries http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx Demo Video 1 - http://youtu.be/cV4Uln6BGUQ Demo Video 2 - http://youtu.be/2NORHci6tbw Demo Video 3 - http://youtu.be/sMtcaXNstw0 Demo Video 4 - http://youtu.be/S-awFK4pNpM -

Reversing/Malware Analysis Training Part 1 - Lab Setup Guide

Virtualization: VmWare - http://www.vmware.com/ VirtualBox - https://www.virtualbox.org/ Tools Development: Compilers/IDE: Dev C++ - http://www.bloodshed.net/devcpp.html Microsoft Visual C++ - http://www.microsoft.com/visualstudio/en-us/products/2010-editions/visual-cpp-express Assemblers: MASM - http://www.masm32.com/ NASM - http://www.nasm.us/ WinAsm (IDE) - http://www.winasm.net/ Langugages: Python - http://python.org/ Tools Reverse Engineering: Disassembler: IDA (5.0) - http://www.hex-rays.com/products/ida/support/download.shtml IDAPython - http://code.google.com/p/idapython/ Debuggers: OllyDbg - http://www.ollydbg.de/ Immunity Debugger - http://immunityinc.com/products-immdbg.shtml Windbg - http://msdn.microsoft.com/en-us/windows/hardware/gg463009 Pydbg - http://code.google.com/p/paimei/ PE file Format: PEView - http://www.magma.ca/~wjr/ PEBrowse - http://www.smidgeonsoft.prohosting.com/pebrowse-pro-file-viewer.html LordPE - http://www.woodmann.com/collaborative/tools/index.php/LordPE ImpRec - http://www.woodmann.com/collaborative/tools/index.php/ImpREC PEid - http://www.peid.info/ vi. ExeScan - http://securityxploded.com/exe-scan.php Process: ProcMon - http://technet.microsoft.com/en-us/sysinternals/bb896645 Process Explorer - http://technet.microsoft.com/en-us/sysinternals/bb896653 Network: WireShark - http://www.wireshark.org/ TcpView - http://technet.microsoft.com/en-us/sysinternals/bb897437 File and Registry: Regshot: http://sourceforge.net/projects/regshot/ Capturebat - http://www.honeynet.org/node/315 InstallWatchPro. - http://www.brothersoft.com/downloads/installwatch-pro-2.5c.html FileMon - http://technet.microsoft.com/en-us/sysinternals/bb896642 Misc: CFFexplorer - http://www.ntcore.com/exsuite.php Notepad++ - http://notepad-plus-plus.org/ Dependency walker - http://www.dependencywalker.com/ Sysinternal Tools - http://technet.microsoft.com/en-us/sysinternals/bb842062

Reversing/Malware Analysis Training Part 2 - Introduction to Windows Internals

Book: Windows Internals 5th Edition - Chapter 1, 2, 3, 5, 9 Windows Architecture - http://technet.microsoft.com/en-us/library/cc768129.aspx Book: RootKit Arsenal - Part 1 - Windows System Architecture System Service Dispatching - http://www.codeproject.com/KB/system/hide-driver/NtCallScheme_small.png

Reversing/Malware Analysis Training Part 3 - Windows PE File Format Basics

Portable Executable File Format - A Reverse Engineer View - Goppit - http://ivanlef0u.fr/repo/windoz/pe/CBM_1_2_2006_Goppit_PE_Format_Reverse_Engineer_View.pdf An In-Depth Look into the Win32 Portable Executable File Format by Matt Pietrek http://msdn.microsoft.com/en-us/magazine/cc301805.aspx Lena 151 tutorials - http://tuts4you.com/download.php?list.17 Icezelion's PE tutorials - http://win32assembly.programminghorizon.com/tutorials.html

Reversing/Malware Analysis Training Part 4 - Assembly Programming Basics

Assembly Programming: A Beginners Guide - http://securityxploded.com/assembly-programming-beginners-guide.php Icezelion's Win32 Assembly Programming Tutorials - http://win32assembly.programminghorizon.com/tutorials.html Function Calling Convention Demystified - http://www.codeproject.com/KB/cpp/calling_conventions_demystified.aspx Intel Manual – Volume 2 (Instruction set), Volume 3 (system programming 3A) - http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf

Reversing/Malware Analysis Training Part 5 - Reverse Engineering Tools Basics

Video - Intro to OllyDbg and its Settings - http://www.youtube.com/watch?v=UqnQCVvYk3A Video - Intro to IDA Pro Disassembler - http://www.youtube.com/watch?v=zvWc-XsBKrA Automation of Reversing Through Scripting - http://securityxploded.com/automation-reversing-scripting.php

Reversing/Malware Analysis Training Part 6 - Practical Reversing (I)

Video Demonstration - Reversing Sample Crackme using IDA Pro http://www.youtube.com/watch?v=6r5Q7YYnUSc Creating KEYGEN for Crackme Code http://securityxploded.com/creating-keygen-for-crackme.php Lena 151 tutorials - part1 to part 10 -http://tuts4you.com/download.php?list.17 Book: 'The IDA Pro Book' - Unofficial Guide to IDA Pro http://www.amazon.com/The-IDA-Pro-Book-Disassembler/dp/1593272898 Book: Practical Malware Analysis - chapter 1-7 http://www.amazon.com/Practical-Malware-Analysis-Dissecting-Malicious/dp/1593272901 Book: Reversing - Secrets of Reverse Engineering - chapter 1,2,3,4,5,8 http://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam/dp/0764574817

Reversing/Malware Analysis Training Part 7 - Practical Reversing II: Unpacking UPX

Video Demonstration - Unpacking UPX using OllyDbg & ImpREC http://http://vimeo.com/42197903 Manual Unpacking of UPX using OllyDbg http://securityxploded.com/unpackingupx.php UPX: Ultimate Packer for Executables http://upx.sourceforge.net/ ImpREC: Import Table Reconstruction Tool http://securityxploded.net/download/Imprec.zip Best Unpacking Tutorials by ARTeam http://www.accessroot.com/

Reversing/Malware Analysis Training Part 8 - Practical Reversing III: Malware Memory Forensics

Demo Video - http://www.youtube.com/watch?v=YcVusDjnBxw Malware Memory Forensics Article http://securityxploded.com/malware-memory-forensics.php Volatility - An advanced memory forensics framework http://code.google.com/p/volatility/ Volatility - Volatile memory analysis research http://volatility.tumblr.com/ MoonSols Windows Memory Toolkit http://www.moonsols.com/windows-memory-toolkit/

Reversing/Malware Analysis Training Part 9 - Practical Reversing IV: Advanced Malware Analysis

Demo Video 1 - http://youtu.be/592uIELKUX8 Demo Video 2 - http://youtu.be/3bxzvrGf5w8 Volatility - An advanced memory forensics framework http://code.google.com/p/volatility/ Volatility - Volatile memory analysis research http://volatility.tumblr.com/ The Honeynet Project - http://www.honeynet.org/node/315 Malware Analysis Tools & Training - http://zeltser.com/reverse-malware/

Reversing/Malware Analysis Training Part 10 - Practical Reversing V: Exploit Development Basics

Demo Video 1 [EIP Overwrite]- http://www.youtube.com/watch?v=erl_Aee8oDg Demo Video 2 [SEH Exploitation]- http://www.youtube.com/watch?v=njQ47H7jO4s Remote Buffer Overflow Exploits - http://securityxploded.com/remote-buffer-overflow-exploits.php Exploit writing tutorials https://www.corelan.be/index.php/articles/

Reversing/Malware Analysis Training Part 11 - Practical Reversing VI: Exploit Development Advanced

Demo Video 1 [DEP Bypass] - http://vimeo.com/49069964 Demo Video 2 [HeapSpray] - http://vimeo.com/49070337 Past, present and future of Windows Exploits: http://bit.ly/vr1IEw Exploit writing tutorials: https://www.corelan.be/index.php/articles/ Preventing the exploitation of SEH overwrite: http://bit.ly/OM6olZ Stack Protections Bypass: http://bit.ly/agDaMx

Reversing/Malware Analysis Training Part 12 - Case Study: Rootkit Analysis

DemoVideo 1: Mader – SSDT Hooking - http://youtu.be/5cLd2HukfbU DemoVideo 2: Prolaco – Process Hiding using DKOM - http://youtu.be/J7odu8OkBYs DemoVideo 3: Darkmegi/waltrodock – Installs Device Driver - http://youtu.be/ZAWfu-tRzrc DemoVideo 4: Carberp – Syscall Patch and Inline Hooks - http://youtu.be/ui_qLL3_w7A Book - The Rootkit Arsenal http://amzn.to/RXHvbN Volatility - An advanced memory forensics framework http://volatility-labs.blogspot.in