Malware analysis has a long learning curve,
that's the line that I always hear every now and then.
The truth is,
malware analysis has lots of things to learn in it.
You can spend years and years
and you will never cover it all.
There's lots of assembly languages,
from x86, x64, ARM, MIPS,
and so many other assembly languages.
You have intermediate languages,
you have JAVA, you have dotNet,
you have compiled Python,
you have compiled visual basic 6,
you have even scripting languages.
You have PHP, you have Pel, you have Powershell,
you have javascript, you have VBA for Macros,
and not only all of this,
you have all the techniques
that are used inside all of them.
From obfuscation, to encryption,
from anti-analysis tricks,
and also different types of behavior.
Including beside all that,
there are the exploits, there's shellcode,
and how they are generated, there's kernel-mode,
and user-mode, there's so many things to learn.
And it is normal to feel very overwhelmed
and to feel that the science is huge.
But when you are starting in malware analysis,
you need first to know what's your goal.
If your goals is to be able to work in malware analysis,
so you need to have only few things to learn
to be able to get your first job in malware analysis.
Look, we are learning every single day
as a malware analyst,
and even when you work in a company,
you don't have to know everything.
You don't have to know how to decompile a Python,
compiled application, like what you see in most CTFs.
What you have to learn,
you have to have your foundation right.
You have to know how to do basic code analysis,
you know how to read code in assembly langauge,
you know how to, you know the malware analysis process,
and you are able to make sense
out of the behavior that you analyzed
through reverse engineering,
either through code analysis,
or even just reading the strings,
you need to understand what this registry key means
from business perspective.
What it means from a malware analysis point of view.
If you see this register key,
you know that this means it tries to attempt resistance,
through this technique, it tries to propagate through that.
It tries to affect this company's assets.
It tries to get into the database,
or through the active directory,
or wherever it affects.
And your able, through your analysis,
through your reverse engineering techniques,
and from you malware analysis background
to answer specific business questions.
How it affects the company assets?
How it affects its confidentiality,
its integrity, its availability?
Wherever the type of assets they are trying to protect,
and how it is spread,
and how it gets more control to the attacker.
Does it have more samples that it downloads?
What are the lateral moves,
and what are the attacker's motivations?
These are the questions that you need to answer,
and actually to learn malware analysis,
you need to learn very few specific things,
to be able to start your first job in malware analysis.
You need to understand assembly, the exit6 assembly, X64,
and to know how to analyze a malware,
to reach this point
when you are answering these basic questions.
And let me tell you this straight forward,
you don't need programming,
you don't need to learn how to write code.
Maybe writing some scripts, some small scripts,
but programming is a huge science.
Programming includes designing,
your in the middle of designing,
classes and object, and object reenter programming,
and how to solve a problem,
and to stick this problem into logical steps
that the computer can understand.
Not only designing the application,
but also writing the application,
but testing, deployment, and so on.
And memory management, and lots of things.
You don't need to learn all of that
and spending time on this is a waste of time.
You need to understand how to read code,
you need to understand how to
maybe just how to make some small pass in small script
in Python or whatever the name that you like to use.
You don't need to dive so deep into programming.
And this is wrong concept.
So, to learn malware analysis really,
you need to be very laser focus
and you need to know what are the resources.
You need to really, treat them
like resources you are learning from.
There are so many entry videos of analysis,
there's so many different techniques,
and protectors, and unpacking,
complicated protectors, and bypassing lots
of anti-analysis tricks,
and analyzing complicated, or strange language,
malware compiled in strange languages like Go language,
or whatever.
And the truth is that these things could be really useful
after you are working for one, two years
in a company already and you have made a sample,
or multiple samples that are using these techniques.
Then that's the time to start learning them
and to start exploring other stuff.
Or if for a time, if you are curious
about how this language work.
I read a recent course about Go language
and how an application could be wrote in Go language
without exploring this language.
However, that's not part of,
that's not one of your goals when learning malware analysis
for the first time.
Malware analysis, you can really learn malware analysis
and get to the interview ready level
in just around six months
or even, like more or less six months.
That including learning the theories,
practicing and analyzing different samples.
And again, you don't need a lot of prerequisites
in order to get into malware analysis.
You don't need to spend three years in SOC,
or in IT admin, or learn network security,
and dive deep into that.
You don't need to have CCNA or CEH,
you may need to learn the foundations
of cybersecurity which will get you more
into reading about CEH and Security+,
but you don't need to learn,
you don't need to get the certificates,
that's for sure and you don't need to get
into how the exam works and get so deep into that.
As well as network protocols,
you need to understand the network protocols
but you do need to understand how's the school routers work,
how the routing stuff works, how port mirroring works,
and all of this stuff.
You just need to understand the protocols,
the structure of these protocols,
and how to use wireshark to analyze different pcaps.
That's all what you need to learn.
And what I just wanted to say is
that be very careful about your time,
choose your resources wisely,
and don't spread yourself too thin into so many resources
that will get you even more lost
and will make your learning curve way way longer.
That's it for today, and see you in the next video.