Advanced Reverse Engineering Malware Training

Advanced Reverse Engineering Malware Training

Course Delivery

This Course is available in the following format:

Request this course in a different delivery format

GSA Schedule 70 Saving for Government Customers

Course Overview:

Advanced Reverse Engineering Malware Training Course with Real World Hands-on Lab

This technically challenging Advanced Reverse Engineering Malware Training course uses the latest malware samples that are the hardest to reverse engineer. You will use every means necessary to defeat all defensive measures employed by malware authors who want to wreak havoc across the internet.

Because modern malware makes use of sophisticated obfuscation techniques, you need to havespecific reversing skills in the deconstruction of various x86 assembler obfuscation tricks used by malware in order to be an expert malware reverser. This four day Advanced Reverse Engineering Malware Training course bridges the gap between reversing “vanilla” compiler generated code and the nontrivial, complex code created by expert malware authors.

Modern malware typically is developed with some measure of Command and Control (C&C)communication capabilities. The C&C protocol can used to maintain a botnet, deliver package updates, send commands, and steal data from compromised machines. Understanding and reversing the underlying C&C protocol is essential to understanding the intention, functionality, and potentially the identity of the malware author. In the Advanced Reverse Engineering Malware Training course, you will learn how to reverse these C&C protocols from live malware examples that are currently in circulation.

Reversing obfuscated malware in some cases must be done programmatically. This requires you to understand how to use specialized plugins for IDA as well as other malware-specific tools in order to de-obsfucate various portions of the code under analysis. In other cases, hours or days of manual work can be saved by learning the proper use of a specific reversing tool. InfoSec Institute will teach you how to use these important tools in a series of hands-on labs during this Advanced Reverse Engineering Malware Training course.

Related Courses

CISA Training | Certified Information Systems Auditor Training
CISM Training | Certified Information Security Manager Training
CISSP Training | Certified Information Systems Security Professional Training
CompTIA Cybersecurity Analyst+ Training | CSA+ Certification Training
CompTIA Security+ Certification Training
Computer Forensics Training
CyberSec First Responder: Threat Detection and Response Training
Cyber Threats Detection and Mitigation Training
Cybersecurity Investigations and Network Forensics Analysis
Ethical Hacking Training | CEH Certification Training
Fundamentals of Information Security Training
Hacker Tools, Techniques, Exploits, and Incident Handling Training
Network Penetration Testing and Ethical Hacking Training
Reverse Engineering Malware Training
Industrial Control Systems – ICS/SCADA Security Essentials Training
Systems Forensics, Investigation, and Response Training

Customize It:

• If you are familiar with some aspects of this Advanced Reverse Engineering Malware Training course, we can omit or shorten their discussion.
• We can adjust the emphasis placed on the various topics or build the Advanced Reverse Engineering Malware Training course around the mix of technologies of interest to you (including technologies other than those included in this outline).
• If your background is nontechnical, we can exclude the more technical topics, include the topics that may be of special interest to you (e.g., as a manager or policy-maker), and present the Advanced Reverse Engineering Malware Training course in manner understandable to lay audiences.

Audience / Target Group:

The target audience for this Advanced Reverse Engineering Malware Training course:

• Information security analysts

What You Will Learn:

Upon completing this Advanced Reverse Engineering Malware Training course, learners will be able to meet these objectives:

• Malicious document analysis
• Extracting and analyzing embedded shell script from documents
• Manually unpacking obfuscated malware
• Methods for Analyzing and Defeating Armored Malware
• Advanced Rootkits, DLL’s and Windows Services
• Advanced Anti-Reversing Malware

Advanced Reverse Engineering Malware Training – Course Syllabus:

Day 1

1. Microsoft Office Malicious Documents

• Instructor will demonstrate methods and techniques for manually analyzing malicious documents without running them against the vulnerable version of MS Office they are targeting.
• Samples of malware

2. Adobe PDF Malicious Documents

• Methods and techniques for manually analyzing these malicious documents without running them against the vulnerable version of Adobe Reader they are targeting
• PDF samples targeting current vulnerabilities using tools

3. Relevant and challenging malware samples in which you must remove the embedded executables for MS Office and Adobe files as the scenario for the day

Day 2

4. Manually Unpacking Obfuscated Malware

• Instructor will describe and demonstrate situations where malware analyst’s tools break and Auto-Unpacking fails
• Analyze a packed executable which will break if attempting to be unpacked through a malware autounpacker
• Manually unpack and restore the original executable
• Students will be given modified version of other real-world packers
• Tools used
• Relevant and challenging malware

Day 3

5. Methods for Analyzing and Defeating Armored Malware

• Common anti-debugging techniques used by malware authors to detect whether or not they are being analyzed
• Common anti-reversing techniques used by malware authors to confuse and increase difficulty of the RE process
• Analyze and bypass anti-debugging checking routines to get the executable to completely unpack
• Combine lessons learned from day 2 to manually unpack and restore the original executable and then defeat the anti-debugging routines.
• Analyze a sample making use of many popular anti-reversing techniques
• Combine lessons learned from day 1, 2, and 3 to manually unpack and restore the original executable, defeat the anti-debugging routines, and finally defeat anti-reversing routines
• Relevant and challenging malware

Day 4

6. Rootkits, DLLs and Windows Services

• Reversing Windows rootkits
• Detect interrupt table hooks and SSDT hooks
• NDIS chains to find backdoor TCP/IP stacks
• Loading DLLs and DLL Exports
• Windows Kernel data structures and what they mean
• Reversing DLLs
• Windows DLLs
• Windows Services
• Windows Services structures
• Service installation and execution routines
• Service lifetime

Day 5

7. Conficker and Relevant Samples
• Manually unpack and restore the original executable
• Defeat the anti-debugging routines
• Defeat anti-reversing routines
• Develop network signatures

Certification & Compliance

Certified Reverse Engineering Analyst:

In any hands on reverse engineer training course, it’s important to have the opportunity to prove, to current or potential employers, that you have the skills you claim you do. This Reverse Engineering Malware Training course prepares you for the premier reverse engineering certification in the industry, the CREA. The exam is given on-site and InfoSec Institute has achieved a 93% pass rate for this certification.

Whether you are looking for general information or have a specific question, we want to help!

Request More Information

Print Friendly, PDF & Email