So, the question that I get asked so many times,
the question that you all want the answer for,
what are the resources I can use
to learn malware analysis?
And, first, before we talk about the resources
and how to learn malware analysis,
let's talk about the basic prerequisites first.
The first thing,
you need to have a good networking background.
You understand protocols, you understand TCP,
UDP, you understand the packet structure
and you know how to use wire shot.
You don't need to go so deep into CCNA
to learn how to do Cisco,
or learn like the routing protocols
or all this stuff,
you just need to understand how the packets work,
how the back structure is,
and the protocol structures.
So, this is the first prerequisite.
The second one,
you need to have a solid cybersecurity background.
You need to understand the basic terminologies in that,
and the best resources could be the CEH or Security+.
You don't need the certificate though,
you don't need to dive so deep into it,
you don't need to prepare for the exams,
you just have to have a basic understanding,
you just need to dive a little bit
into one of these two directions
and understand what they are teaching.
Once you have the prerequisites,
now you can start to learn malware analysis.
And there's two things you need to learn
in malware analysis.
You need to learn reverse engineering
and you need to learn malware analysis.
Reverse engineering is to be able
to reverse any application,
whether it's compiled into a assembly language,
and there are multiple assembly languages,
or it's compiled into intermediate languages,
like dotNet, or JAVA, or Python even,
and also able to analyze scripts,
able to reverse the scripts
and understand what they're doing.
I'm used scripts like VBA for Macros,
javascript, PHP, Perl, Go Language,
Powershell, whatever the language is.
And to learn that,
first you need to learn a simply language.
You don't need just to make sure you know that,
you don't need to learn how to write code
in assembly language,
you just need to learn how to read code.
You don't need to be a programmer beforehand
to be able to understand the assembly.
However, the resources that are out there,
most of them, if not all of them,
they require you to be a programmer
to be able to understand it.
That's unfortunately.
The best resource, that if you are a programmer,
this will be very helpful to you.
If not, you will struggle,
but you will need some time to get used to it,
which is Iczelion's tutorials.
It's very famous tutorials
on assembly language.
This is for the assembly.
There are resources to learn
how to do reverse engineering
after you know a little bit of the basics
of assembly language,
and there are two books that I would recommend:
Reversing: The Secrets of Reverse Engineering,
it's a very old book,
like really, really old.
However, it is really, really good.
There is lots of things you learn out of that book.
Some things and some tools are obsolete now,
but it is still a very useful book.
Another book that you can start reading,
and it could help you with assembly as well,
which is: Reverse Engineering for Beginners.
It's a free book, completely free,
can see it in so many languages
and you can find it in beginner.re.
All the links I will include in the description,
down below, or above, or whatever,
wherever you are reading, or watching this video.
So, these are the first, these are for reverse engineering.
Also, you need to understand more
about the operating system and internals
and the best resource is a book called:
Identify Malicious Code Through Reverse Engineering.
And this book, the first half of the book,
the first section of that book,
if really, really good at understanding Windows internals.
The second part is not very important,
but the first part is very, very good.
The book is small, it's not really a big book,
and you just need to read the first half of it
to have quite a solid understanding
of how the operating system works.
If you want to dive deeper into that,
really, really deeper,
then you can use Windows Internals.
It's a really huge book, it's more a reference,
but if you want to dive into specific topic,
this book would be, could be very useful.
This for the reverse engineering.
When it comes to...
Before I go into the other part,
reverse engineering,
for you to practice what you have learned.
So this is where to learn all the theory
and learn how all of this works,
you need practice a little bit in reversing,
the secrets of reverse engineering,
you know how to analyze a malware here and there,
but to practice more, you need to start working
on some crack-mes.
There's a website in the past,
who is called crackmes.de
This website it down.
This website used to have lots of crack-mes,
lots of challenges, from level one to level ten,
and there were people who were solving them
and putting the solution online.
So you can actually work on this crack-me,
try your luck, if you cracked it great,
if you didn't you could read the solutions.
This website, there is mirror of that website
I think in tuts4you.com
You can check it out, you can download it,
and you can, if you get there,
get from the level one until level three,
or four, or five, wherever you want to reach.
This is for the reverse engineering.
For malware analysis, malware analysis
for the second part is the malware analysis.
And it's very important that,
not only you analyze the malware and know what it's doing,
but you need to make sense of what this behavior is doing.
What's this behavior's
actually helping the attacker achieve?
Let's say you want to answer specific questions,
how it maintain persistence?
If the malware is modifying the search history entry,
what does that mean?
Oh, it means if he's modifying this,
he's maintaining persistence,
or he is trying to propagate through a network.
If he's creating this file in that fileshare,
or things like that.
So, you need to make sense of the malware behavior
and you need to answer the specific questions
that most of the security team,
or the instant response teams wants you to answer.
And they are mostly basic questions:
How it propagates?
How much control it gives to the attacker?
What are the lateral movements?
Does it download more malware?
Does it spread through a network?
Does it spread through USB?
How does it spread through network,
how it goes to the next level?
Whatever the questions are.
To learn malware analysis
and to learn how to understand
what the malware are doing and understand all of that,
there are multiple books to use.
The first one, which is: Practical Malware Analysis.
It will help you also in reverse engineering
and learning assembly and so on.
Another book is: Learning Malware Analysis,
by Monnappa K. A.
This is more new, so I would assume it's updated,
it's more updated than Practical Analysis,
but both books are great.
After that, after you read these books enough
until you start practicing with them,
these two books will give you the basics.
They are not very, very deep,
so this is the first level.
And the second level, you can check:
Mastering Malware Analysis,
that's a book that I have published
with Alexey Kleymenov and it gets you to the next level.
This is learning the theory,
the same as we did with reverse engineering.
Now you want to practice.
You need to download lots of different malware samples
and you need also the solutions
as we did with the crack-mes.
You need to see a malware analysis reports
for these malwares.
To download lots of malware samples,
especially the malwares that are known
and have an analysis reports out there by big companies.
You can look at contagiodump.blogspot.com,
it's a website, or a blog,
that was created by Mila Parkour
and she's a security researcher.
And she has collected lots of samples,
especially for known APT attacks,
with their names, with their categories.
These malware samples have been analyzed
by so many different companies, including:
FireEye, Symantec, Kaspersky,
and there reports, their malware analysis reports
are out there.
You can check them out.
There's a guy who collected so many reports
from all of these companies
and put them into one big repository on github.
It's called APT notes, APT for APT attacks,
APT notes, and I will put the links all around.
So, basically, he collected all these reports,
you can check these reports.
See what are the malware samples related to these reports,
get them from contagio ,
the samples that she has collected,
start analyzing them, look at the reports,
and learn from them
and see how you are getting compared
to the analysis reports that are out there.
So, that is basically most of the resources.
Once you get a grip of the,
this will help you in the reverse engineering,
it will help you also analyzing different markers,
because some of them are different documents,
or phishing, or emails, or javascript code,
and the science is the same.
Reverse engineering is the same.
Whether if you're analyzing assembly language,
or a VVE markers, or a javascript,
or Powershell.
You will see that the evidence is
that you are looking for is always the same.
You are looking for how download the next phase,
you will see download file, or download URL to file.
And these are commands that are used in assembly,
Windows commands, or APIs, that are used in Windows,
used in exe applications,
it's used in VBA macros,
it's used as well in Powershell.
So, it's the same things you are looking for.
The same clues and the same evidences
and with the same malware analysis background,
you can make sense of this behavior
and understand what they mean
in the malware analysis context
and what previews,
and what it gives actually to the attacker
and how it helps him achieve what he's trying to achieve.
So, that's for the main resources.
Also, I wanted to tell you that,
to inform you that,
I also have a malware analysis training,
a complete malware analysis training.
And this training,
I really created for the people
who more coming from administration background,
or from non-programming background.
And they want to work,
they want to learn malware analysis,
they want to work in this field,
they want to build their career and build their resume
so they can actually apply for a job
and able to get a job in malware analysis.
It's a complete training,
it takes you from complete beginner,
into the level that you are interview ready,
so that you can get a job very soon.
So, I will put the link for this training
around here.
You guys can check it out.
It's maltrak.com/join.
I wish to see you there,
and anyway,
if you have anymore questions just let me know.
If you have more resources that you recommend as well,
let me know in the comments below,
what resources that you find useful,
what books you find useful,
and yeah, see you in the next video, bye-bye.