So, what you should not learn to be a malware analyst.
I know this sounds a bit strange,
"What do you mean there's something
with what I should not learn
to be a malware analyst?".
But, here's the thing,
malware analysis is really, really a huge field.
It's a huge, it's very daunting,
and if you try to learn so many different things,
especially at the beginning,
it may take you one, two, or three years
until you are in an interview ready level.
But there are lots of things that you should not focus on
at the beginning in your malware analysis career.
In fact, you should not even learn them
before you get a job in malware analysis.
After I got my first job, and the second, and third,
there are so many things that I started to learn
and things that I'm learning right now,
let's say reversing a malware written go language,
or things like that.
Even how to analyze a Mac malware,
is something that I started with very recently.
So, you don't need to learn everything at the beginning,
and here are some of the things
that you really have to skip.
And there's so many people
who're actually falling into that.
Here are the things that you should skip learning,
especially at the beginning.
First, you should not go for CCNA
for basics for malware analysis.
You need network background, yes.
You need to understand protocols, yes.
But here are the most important protocols.
Like you need to learn TCP, IP, UDP, HTTPS,
and some of this application protocols.
But, you don't need to learn all the routing protocols,
even the ARP protocol, you don't need to learn about.
This is to be, and all of these protocols
you don't really need
to learn about them in malware analysis.
Especially at the beginning.
And of course, you don't need to learn how to use Cisco.
For me, until now, I don't even know how to use Cisco.
I never used a real router before,
like a real Cisco router before.
I have touched base with the commands
and dealing with their security advisors,
but I never actually use the device,
and I don't need that, especially in malware analysis.
So there's the first thing.
The second thing, you don't need to learn how to
decompile a Python malware,
or dealing with the Lennox malware in X64 is packed,
or things like that that you see so many times in CTFs.
People join CTFs,
and they think this will help get them the skills
that they can use in malware analysis
or any other field they are trying to learn.
But here's the truth, especially in malware analysis,
it is a huge field and you need to be very sharp, focused,
at the beginning if you want to learn malware analysis
in the first six-months, or be at an interview ready level
in six-months or one year.
Then you need to skip so many different things
that are actually not important at the beginning.
So, don't try to run after this interesting stuff.
They're really interesting and there's lots of curiosity.
I always have curiosity for them.
However, they are not the fundamentals.
You need to focus on the fundamentals.
Third thing, you don't need to learn programming.
So here's the thing,
programming is really big field.
It's about problem-solving,
it's about dissecting the problem
into logical steps the computer can understand.
It's about designing an application,
structuring the application,
creating classes, objects, structures,
functions that talk to each other.
You need to code all of that
and then testing, deployment,
all of these things, that's all programming.
You don't need all of that.
Definitely don't need all of that in malware analysis.
You may need to learn the syntax of some languages.
Some basics about programming,
because you'll be reading codes
and you will not be writing that much.
You will mostly be reading code.
And optional, kind of between mandatory and optional,
at the end of your learning malware analysis process,
you will need to learn how to use Python
in order to meet some tasks in malware analysis.
Let's say a malware that has 30 functions
that need to be decrypted,
or 30 strings that need to be decrypted
and you need to meet that in Python.
It could be like ten lines of code.
However, you do need programming as a whole.
So trying to get a job of course,
C++ course, or something like that
as an intro to modern analysis
would be mostly a waste of time.
However, you would need to learn the syntax.
And those, well, you do need to understand how to deal
with so many different programming languages, including:
let's say AutoIt, you will touch base with PHP,
with Powershell, with JAVA, with CSharp,
with all of these things.
You will be in touch base with them.
But, the reverse engineering skills you build
while analyzing malware, works in all of these languages.
I never wrote a single line in Perl.
Maybe I wrote a single line,
but I didn't write in Perl,
I didn't write in AutoIt,
I didn't write in so many different languages,
that I have actually, or even PHP.
But I have actually analyzed different malware
or malware samples that are written in these languages.
So, you need to learn the reverse engineering skills
and understand the general syntax
and that's all of it.
If you are dealing with a new malware
with different languages,
you have never wrote a single line before in this language,
including JAVA, you don't need to learn the language,
you just have to use a bit of Google
and you what you have learned already
from understanding the basic C++ syntaxes.
So, you don't need to go deeper in programming.
And last, you don't need to learn how to deal
with algorithms, for example, or lots of mathematics,
or all of that encryption.
Like, the encryption algorithms
and all the things behind it, you don't really need.
The same for electronics, or things like that,
you don't need that.
Except if you will be specialized in IRT,
you will have to deal with hardware and electronics,
or you want to be actually working cryptographia,
then you will need to lean cryptographian algorithms.
But in malware analysis the normal malware analysis,
you don't need to deal with all of that.
You definitely don't need to learn data structures,
algorithms, mathematics.
You don't need all of that in learning malware analysis.
So, that's how to skip so many things
that actually could be wasting your time.
If you want to know what actually you should learn
and to what actually the roadmap that you have to follow.
What are the common wrong beliefs,
same as I mentioned today,
and what are the ways to deal with all the logisticals.
I have created a masterclass, long time ago.
I have recorded it.
And this masterclass,
I actually explained all the steps
that you have to follow
to build your skills in malware analysis
in a short time.
There's no shortcut,
but this is actually a fast way you can learn.
I will put the link maybe somewhere here.
So check it out,
and see you in the next video, bye-bye.
And see you in the next video, bye-bye.
So, the question that I get asked so many times,
the question that you all want the answer for,
what are the resources I can use
to learn malware analysis?
And, first, before we talk about the resources
and how to learn malware analysis,
let's talk about the basic prerequisites first.
The first thing,
you need to have a good networking background.
You understand protocols, you understand TCB,
UDP, you understand the packet structure
and you know how to use wire shot.
You don't need to go so deep into CCNA
to learn how to do Cisco,
or learn like the routing protocols
or all this stuff,
you just need to understand how the packets work,
how the back structure is,
and the protocol structures.
So, this is the first prerequisite.
The second one,
you need to have a solid cybersecurity background.
You need to understand the basic terminologies in that,
and the best resources could be the CEH or Security+.
You don't need the certificate though,
you don't need to dive so deep into it,
you don't need to prepare for the exams,
you just have to have a basic understanding,
you just need to dive a little bit
into one of these two directions
and understand what they are teaching.
Once you have the prerequisites,
now you can start to learn malware analysis.
And there's two things you need to learn
in malware analysis.
You need to learn reverse engineering
and you need to learn malware analysis.
Reverse engineering is to be able
to reverse any application,
whether it's compiled into a assembly language,
and there are multiple assembly languages,
or it's compiled into intermediate languages,
like dotNet, or JAVA, or Python even,
and also able to analyze scripts,
able to reverse the scripts
and understand what they're doing.
I'm used scripts like VBA for Macros,
javascript, PHP, Perl, Go Language,
Powershell, whatever the language is.
And to learn that,
first you need to learn a simply language.
You don't need just to make sure you know that,
you don't need to learn how to write code
in assembly language,
you just need to learn how to read code.
You don't need to be a programmer beforehand
to be able to understand the assembly.
However, the resources that are out there,
most of them, if not all of them,
they require you to be a programmer
to be able to understand it.
That's unfortunately.
The best resource, that if you are a programmer,
this will be very helpful to you.
If not, you will struggle,
but you will need some time to get used to it,
which is Iczelion's tutorials.
It's very famous tutorials
on assembly language.
This is for the assembly.
There are resources to learn
how to do reverse engineering
after you know a little bit of the basics
of assembly language,
and there are two books that I would recommend:
Reversing: The Secrets of Reverse Engineering,
it's a very old book,
like really, really old.
However, it is really, really good.
There is lots of things you learn out of that book.
Some things and some tools are obsolete now,
but it is still a very useful book.
Another book that you can start reading,
and it could help you with assembly as well,
which is: Reverse Engineering for Beginners.
It's a free book, completely free,
can see it in so many languages
and you can find it in beginner.re.
All the links I will include in the description,
down below, or above, or whatever,
wherever you are reading, or watching this video.
So, these are the first, these are for reverse engineering.
Also, you need to understand more
about the operating system and internals
and the best resource is a book called:
Identify Malicious Code Through Reverse Engineering.
And this book, the first half of the book,
the first section of that book,
if really, really good at understanding Windows internals.
The second part is not very important,
but the first part is very, very good.
The book is small, it's not really a big book,
and you just need to read the first half of it
to have quite a solid understanding
of how the operating system works.
If you want to dive deeper into that,
really, really deeper,
then you can use Windows Internals.
It's a really huge book, it's more a reference,
but if you want to dive into specific topic,
this book would be, could be very useful.
This for the reverse engineering.
When it comes to...
Before I go into the other part,
reverse engineering,
for you to practice what you have learned.
So this is where to learn all the theory
and learn how all of this works,
you need practice a little bit in reversing,
the secrets of reverse engineering,
you know how to analyze a malware here and there,
but to practice more, you need to start working
on some crack-mes.
There's a website in the past,
who is called crackmes.de
This website it down.
This website used to have lots of crack-mes,
lots of challenges, from level one to level ten,
and there were people who were solving them
and putting the solution online.
So you can actually work on this crack-me,
try your luck, if you cracked it great,
if you didn't you could read the solutions.
This website, there is mirror of that website
I think in tuts4you.com
You can check it out, you can download it,
and you can, if you get there,
get from the level one until level three,
or four, or five, wherever you want to reach.
This is for the reverse engineering.
For malware analysis, malware analysis
for the second part is the malware analysis.
And it's very important that,
not only you analyze the malware and know what it's doing,
but you need to make sense of what this behavior is doing.
What's this behavior's
actually helping the attacker achieve?
Let's say you want to answer specific questions,
how it maintain persistence?
If the malware is modifying the search history entry,
what does that mean?
Oh, it means if he's modifying this,
he's maintaining persistence,
or he is trying to propagate through a network.
If he's creating this file in that fileshare,
or things like that.
So, you need to make sense of the malware behavior
and you need to answer the specific questions
that most of the security team,
or the instant response teams wants you to answer.
And they are mostly basic questions:
How it propagates?
How much control it gives to the attacker?
What are the lateral movements?
Does it download more malware?
Does it spread through a network?
Does it spread through USB?
How does it spread through network,
how it goes to the next level?
Whatever the questions are.
To learn malware analysis
and to learn how to understand
what the malware are doing and understand all of that,
there are multiple books to use.
The first one, which is: Practical Malware Analysis.
It will help you also in reverse engineering
and learning assembly and so on.
Another book is: Learning Malware Analysis,
by Monnappa K. A.
This is more new, so I would assume it's updated,
it's more updated than Practical Analysis,
but both books are great.
After that, after you read these books enough
until you start practicing with them,
these two books will give you the basics.
They are not very, very deep,
so this is the first level.
And the second level, you can check:
Mastering Malware Analysis,
that's a book that I have published
with Alexey Kleymenov and it gets you to the next level.
This is learning the theory,
the same as we did with reverse engineering.
Now you want to practice.
You need to download lots of different malware samples
and you need also the solutions
as we did with the crack-mes.
You need to see a malware analysis reports
for these malwares.
To download lots of malware samples,
especially the malwares that are known
and have an analysis reports out there by big companies.
You can look at contagiodump.blogspot.com,
it's a website, or a blog,
that was created by Mila Parkour
and she's a security researcher.
And she has collected lots of samples,
especially for known APT attacks,
with their names, with their categories.
These malware samples have been analyzed
by so many different companies, including:
FireEye, Symantec, Kaspersky,
and there reports, their malware analysis reports
are out there.
You can check them out.
There's a guy who collected so many reports
from all of these companies
and put them into one big repository on github.
It's called APT notes, APT for APT attacks,
APT notes, and I will put the links all around.
So, basically, he collected all these reports,
you can check these reports.
See what are the malware samples related to these reports,
get them from contagio ,
the samples that she has collected,
start analyzing them, look at the reports,
and learn from them
and see how you are getting compared
to the analysis reports that are out there.
So, that is basically most of the resources.
Once you get a grip of the,
this will help you in the reverse engineering,
it will help you also analyzing different markers,
because some of them are different documents,
or phishing, or emails, or javascript code,
and the science is the same.
Reverse engineering is the same.
Whether if you're analyzing assembly language,
or a VVE markers, or a javascript,
or Powershell.
You will see that the evidence is
that you are looking for is always the same.
You are looking for how download the next phase,
you will see download file, or download URL to file.
And these are commands that are used in assembly,
Windows commands, or APIs, that are used in Windows,
used in exe applications,
it's used in VBA macros,
it's used as well in Powershell.
So, it's the same things you are looking for.
The same clues and the same evidences
and with the same malware analysis background,
you can make sense of this behavior
and understand what they mean
in the malware analysis context
and what previews,
and what it gives actually to the attacker
and how it helps him achieve what he's trying to achieve.
So, that's for the main resources.
Also, I wanted to tell you that,
to inform you that,
I also have a malware analysis training,
a complete malware analysis training.
And this training,
I really created for the people
who more coming from administration background,
or from non-programming background.
And they want to work,
they want to learn malware analysis,
they want to work in this field,
they want to build their career and build their resume
so they can actually apply for a job
and able to get a job in malware analysis.
It's a complete training,
it takes you from complete beginner,
into the level that you are interview ready,
so that you can get a job very soon.
So, I will put the link for this training
around here.
You guys can check it out.
It's maltrak.com/join.
I wish to see you there,
and anyway,
if you have anymore questions just let me know.
If you have more resources that you recommend as well,
let me know in the comments below,
what resources that you find useful,
what books you find useful,
and yeah, see you in the next video, bye-bye.
Malware analysis has a long learning curve,
that's the line that I always hear every now and then.
The truth is,
malware analysis has lots of things to learn in it.
You can spend years and years
and you will never cover it all.
There's lots of assembly languages,
from x86, x64, ARM, MIPS,
and so many other assembly languages.
You have intermediate languages,
you have JAVA, you have dotNet,
you have compiled Python,
you have compiled visual basic 6,
you have even scripting languages.
You have PHP, you have Pel, you have Powershell,
you have javascript, you have VBA for Macros,
and not only all of this,
you have all the techniques
that are used inside all of them.
From obfuscation, to encryption,
from anti-analysis tricks,
and also different types of behavior.
Including beside all that,
there are the exploits, there's shellcode,
and how they are generated, there's kernel-mode,
and user-mode, there's so many things to learn.
And it is normal to feel very overwhelmed
and to feel that the science is huge.
But when you are starting in malware analysis,
you need first to know what's your goal.
If your goals is to be able to work in malware analysis,
so you need to have only few things to learn
to be able to get your first job in malware analysis.
Look, we are learning every single day
as a malware analyst,
and even when you work in a company,
you don't have to know everything.
You don't have to know how to decompile a Python,
compiled application, like what you see in most CTFs.
What you have to learn,
you have to have your foundation right.
You have to know how to do basic code analysis,
you know how to read code in assembly langauge,
you know how to, you know the malware analysis process,
and you are able to make sense
out of the behavior that you analyzed
through reverse engineering,
either through code analysis,
or even just reading the strings,
you need to understand what this registry key means
from business perspective.
What it means from a malware analysis point of view.
If you see this register key,
you know that this means it tries to attempt resistance,
through this technique, it tries to propagate through that.
It tries to affect this company's assets.
It tries to get into the database,
or through the active directory,
or wherever it affects.
And your able, through your analysis,
through your reverse engineering techniques,
and from you malware analysis background
to answer specific business questions.
How it affects the company assets?
How it affects its confidentiality,
its integrity, its availability?
Wherever the type of assets they are trying to protect,
and how it is spread,
and how it gets more control to the attacker.
Does it have more samples that it downloads?
What are the lateral moves,
and what are the attacker's motivations?
These are the questions that you need to answer,
and actually to learn malware analysis,
you need to learn very few specific things,
to be able to start your first job in malware analysis.
You need to understand assembly, the exit6 assembly, X64,
and to know how to analyze a malware,
to reach this point
when you are answering these basic questions.
And let me tell you this straight forward,
you don't need programming,
you don't need to learn how to write code.
Maybe writing some scripts, some small scripts,
but programming is a huge science.
Programming includes designing,
your in the middle of designing,
classes and object, and object reenter programming,
and how to solve a problem,
and to stick this problem into logical steps
that the computer can understand.
Not only designing the application,
but also writing the application,
but testing, deployment, and so on.
And memory management, and lots of things.
You don't need to learn all of that
and spending time on this is a waste of time.
You need to understand how to read code,
you need to understand how to
maybe just how to make some small pass in small script
in Python or whatever the name that you like to use.
You don't need to dive so deep into programming.
And this is wrong concept.
So, to learn malware analysis really,
you need to be very laser focus
and you need to know what are the resources.
You need to really, treat them
like resources you are learning from.
There are so many entry videos of analysis,
there's so many different techniques,
and protectors, and unpacking,
complicated protectors, and bypassing lots
of anti-analysis tricks,
and analyzing complicated, or strange language,
malware compiled in strange languages like Go language,
or whatever.
And the truth is that these things could be really useful
after you are working for one, two years
in a company already and you have made a sample,
or multiple samples that are using these techniques.
Then that's the time to start learning them
and to start exploring other stuff.
Or if for a time, if you are curious
about how this language work.
I read a recent course about Go language
and how an application could be wrote in Go language
without exploring this language.
However, that's not part of,
that's not one of your goals when learning malware analysis
for the first time.
Malware analysis, you can really learn malware analysis
and get to the interview ready level
in just around six months
or even, like more or less six months.
That including learning the theories,
practicing and analyzing different samples.
And again, you don't need a lot of prerequisites
in order to get into malware analysis.
You don't need to spend three years in SOC,
or in IT admin, or learn network security,
and dive deep into that.
You don't need to have CCNA or CEH,
you may need to learn the foundations
of cybersecurity which will get you more
into reading about CEH and Security+,
but you don't need to learn,
you don't need to get the certificates,
that's for sure and you don't need to get
into how the exam works and get so deep into that.
As well as network protocols,
you need to understand the network protocols
but you do need to understand how's the school routers work,
how the routing stuff works, how port mirroring works,
and all of this stuff.
You just need to understand the protocols,
the structure of these protocols,
and how to use wireshark to analyze different pcaps.
That's all what you need to learn.
And what I just wanted to say is
that be very careful about your time,
choose your resources wisely,
and don't spread yourself too thin into so many resources
that will get you even more lost
and will make your learning curve way way longer.
That's it for today, and see you in the next video.
Bye bye.
Why learning malware analysis is so difficult?
I see this frustration in so many people
when they are starting to learn malware analysis.
And then partly there are two reasons for that.
The first reason is this
people start to learn from so many different resources,
especially resources that are not really used to teach,
YouTube videos and some different articles here and there.
And the problem is that what you see,
in lots of YouTube videos especially,
is that these videos, they don't teach you
how do you reach that point of understanding?
They just show you how this malware could be analyzed.
You click, three clicks here, you look here, you see that,
you see this command, this command means this,
and this, and that, and they give you the answer this way.
Unfortunately it doesn't tell you how he thought
about this answer, how he discovered in the first place
what he used Google for and how he got this information.
The truth is that when we do our analysis for malware,
we don't just click five times if it,
and we reach a specific point, to a specific number,
we magically know that this is the time
to start doing one, two, three, four,
and voila, the malware is unpacked,
or the protector has been bypassed.
The truth is, it's not like that.
We get into fail many times,
and you need to see that to be able to understand
how malware analyzing, and how he unstuck himself
when he gets stuck.
How he even used Google and what commands he doesn't know,
and how he actually get to outsource from outside
to learn about different commands,
and different techniques, and different things.
Because once you understand how he does his research,
you'll be able to do that yourself
when you're analyzing a malware.
Unfortunately, lots of YouTube videos,
yes, they are not really good for teaching.
And you need to find, you need to be very very selective
on new resources when you're learning malware analysis.
The second reason is that lots of resources
that teach malware analysis are there
assuming that the people
are actually computer science graduates,
who actually worked as developers,
or in some different companies.
But the truth is that most of the people
who are learning malware analysis especially these days
are from different background.
They are from administration background,
or cybersecurity background like a SOC analyst,
or network security,
and they want to shift their career into malware analysis.
And their background's the same like me,
they are not coming from computer science background,
or from developing background, from programming background.
And that's why they find their resources very difficult.
Unfortunately that's a common thing in the market
that most of their sources are more for programmers,
and that's why you need to understand first:
what are your skills?
What are your capabilities?
And what resources that suits you the best?
So, again, you need to be very very selective
on the resources you're learning from,
you need to see what are the language they are using,
and what prerequisites that they assume
that the student actually have, or has,
before he start learning, or start reading that book,
or start consuming this information.
So, malware analysis is not very difficult
if you have the right resources to learn.
I just wanted to mention at the end of this video
that, which we are in the end now,
that I have actually a malware analysis training
that's created mainly for the people
who are from administration background.
If they are IT admins or SOC analysts,
or people who are actually students even,
not in computer science,
people who don't have this programming background
and they don't these prerequisites
that's required in every single book or training out there.
I hope these people learn malware analysis.
Practically actually, we do analyze malware together,
and when I do the malware analysis with them,
I actually show them how exactly I think.
It's a recorded video, the training,
and I show you exactly how I think in every single step.
I don't just get the answer assuming the answer.
Some of the videos actually recorded
that I see this malware for the first time,
and they do the analysis on that malware for the first time.
And I start to think, okay,
I don't know this information, and start to search for it.
And I also show you that I know what level you are
at that, before watching this video,
and I know what commands you know, and what you don't know,
and how you can research to know more
and to be able to analyze malware,
that has new commands or new stuff
that you haven't seen before.
So I will put the link of this video around here.
It's maltrak.com/join, or /go.
Yeah, and I hope to see you there.
See you in the next video, bye bye