Masterclass: Malware Analysis & Reverse Engineering

Module 1. APT Attacks & Malware Analysis

1. Understanding advanced persistent threats
2. Attacker tactics, techniques & procedures (MITRE ATT&CK)
3. The incident response process for malware attacks
4. APT attack vectors and types of malware
5. Setting up isolated lab environment

Module 2. Basic Static Analysis

1. Investigating malware decrypted strings
2. Examining malware headers (PE)
3. Understanding functionality through imported Windows APIs
4. Detecting and unpacking encrypted malware
5. Hands-on lab with real malware samples

Module 3. Behavioral Analysis & Sandboxing

1. Network forensics for malware activity
2. Monitoring process, file system, and registry activity
3. Determining indicators of compromise (IoCs)
4. Hands-on lab analyzing real malware

Module 4. Spear-phishing Attacks with Malicious Documents

1. Analyzing malicious Office documents with VBA macros
2. Examining and dissecting malicious PDF files
3. Hands-on lab with real phishing documents

Module 5. Intro To x86/x64 Assembly

1. CPU registers and assembly instructions
2. Assembly language and memory handling
3. Reversing assembly code to higher-level languages
4. Working with variables and memory structures

Module 6. Static & Dynamic Code Analysis

1. Using IDA Pro for static analysis
2. Hands-on lab with static code analysis
3. Using Ollydbg/x64dbg for dynamic analysis
4. Investigating Windows API calls
5. Key indicators in code analysis

Module 7. Malware Functionalities Analysis

1. Analyzing droppers & downloaders
2. Persistence mechanisms
3. Keylogging techniques
4. Banking Trojans & Man-in-the-Browser attacks
5. Point of Sale malware characteristics
6. Writing custom YARA rules

Module 8. Unpacking Packed Samples

1. Using generic unpackers
2. Manual unpacking techniques
3. Overcoming anti-reverse engineering protections

Module 9. Dealing with Encryption

1. Reversing basic encryption algorithms
2. Working with complex encryption (RC4, AES, public key)
3. Uncovering encrypted strings, APIs, and C2 domains
4. Hands-on lab with encrypted malware

Module 10. Ransomware analysis

1. Basic analysis of ransomware behavior
2. Code analysis of encryption functionality
3. Understanding file encryption algorithms
4. Assessing decryption possibilities
5. Real-world ransomware case study

Module 11. Windows Forensics & Timeline Analysis

1. Digital forensics goals and acquisition techniques
2. Analyzing NTFS Master File Table and deleted files
3. Windows Change Logs and Prefetch analysis
4. Registry analysis for persistence
5. Creating attacks timelines

Module 12. Advanced Techniques: Fileless Malware & API Hooking

1. Understanding process internals
2. Detecting code injection techniques
3. Process hollowing analysis (Stuxnet technique)
4. API Hooking and IAT hooking detection

Module 13. Memory Forensics & Volatility

1. Memory acquisition techniques
2. Introduction to Volatility framework
3. Identifying suspicious processes
4. Detecting injected and hidden DLLs
5. Hands-on with Stuxnet memory dump

Module 14. Reporting & Threat Hunting

1. Professional malware analysis report writing
2. Introduction to threat hunting
3. Endpoint threat hunting with Sysmon
4. Creating Sigma rules