RC
Uploaded byRamin Farajpour Cami
PPTX, PDF318 views

Malware Analysis

This document provides an overview of methodologies for handling security incidents, including threat hunting, malware analysis, incident response, and threat intelligence. It discusses the skills, tools, and techniques involved in each methodology. For malware analysis, it describes skills like reverse engineering and static/dynamic analysis. It also lists resources for malware analysis like tools for static analysis, reverse engineering, and reporting.

Technology◦
Related topics:
Information Security•

Embed presentation

Downloaded 13 times
R A M I N FA R A J P O U R C A M I T W I T T E R : M F 4 R R 3 L L G I T H U B : @ R A M I N F P Malware Analysis
METHODOLOGY FOR HANDLING SECURITY INCIDENTS, BREACHES, AND CYBER THREATS • 1] Threat Hunting • 2] Malware Analysis • 3] Incident Response • 4] Threat Intelligence
WHAT IS THREAT HUNTING? • The process of proactively and iterative searching through networks to detect and isolate advanced threats that evade existing security solutions. – Analysis track – Intercept – Eliminate adversaries lurking in a network – Tools : SIEM, IDS, Firewall • Video : https://www.exabeam.com/product/exabeam-threat-hunter/
THREAT HUNTER SKILLS • Data analytics and reporting skills — these include pattern recognition, technical writing, data science, problem solving and research. • Operating systems and networks knowledge — needs to know the ins and outs of the organizational systems and network. • Information security experience — including malware reverse engineering, adversary tracking and endpoint security. A threat hunter needs to have a clear understanding past and current tactics, techniques and procedures (TTPs) used by the attackers. • Programming language — at least one scripting language and one compiled language is common, though modern tools are increasingly eliminating the need for using scripting language.
THREAT HUNTING REFERENCE Name Description Attack&Ck Website for Information related to Hunting Techniques. The ThreatHunting Project Website for Information to start Threat HUNTPEDIA A very handfull book.
THREAT HUNTING TOOLS Name Version Description ELK Free A platform which help to create usecasses for threat huntng and hypothesis. Sysmon Free System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. Osquery Free Performant endpoint visibility, Supoort all OS platform.
ELK • Beats - https://github.com/elastic/beats – Docs : https://github.com/elastic/beats#documentation-and-getting-started • ElasticSearch - https://www.elastic.co/elasticsearch/ • Logstash - https://github.com/elastic/logstash • Kibana - https://www.elastic.co/kibana/
WHAT IS MALWARE ANALYSIS ? • The process of understanding the behavior and purpose of a suspicious file or URL. The output of the analysis aids in the detection and mitigation of the potential threat – Malware investigation – Malware performance – The purpose of the malware – Malicious level of malware – Traffic analysis sent – How to connect to the server – Malware code structure – IOC with YARA/Snort • Malware analysis is that it helps Incident Responders (IR) and security analysts (ALERT)
MALWARE ANALYSIS SKILLS • Networking • IOC (indicator Analysis)  YARA / Snort • Static Analysis • Dynamic Analysis • Memory Forensics • RE (Reverse Engineering) • File Format • OS Internal • Coding / Script
WHAT IS INCIDENT RESPONSE ? • Structured approach to handle various types of security incidents, cyber threats, and data breaches. • The incident response methodology aims to identify, contain, and minimize the cost of a cyberattack or a live incident. • Why Is Incident Response Important? – Data breaches cost companie’s operational downtime, reputational, and financial loss. – For most of the organizations, breaches lead to devaluation of stock value and loss of customer trust. – To eliminate such risks, companies need a well-planned cybersecurity incident response plan, • https://youtu.be/NIKIJodcxOk
GRAPHITE – GRAFANA - DIAMOND • https://graphiteapp.org/ • https://github.com/grafana/grafana • Or https://github.com/prometheus/prometheus • https://github.com/python-diamond/Diamond Installing : https://github.com/SecurityTalks/Malware-Analysis
WHAT ARE THE COMMON TYPES OF INCIDENTS?
WHAT IS THREAT INTELLIGENCE? • Cyber threat information becomes once it has been collected, evaluated in the context of its source and reliability, and analyzed • It requires that analysts identify similarities and differences in vast quantities of information and detect deceptions to produce accurate, timely, and relevant intelligence.
THREAT INTELLIGENCE RESOURCE dydns Free Online emergingthreats for botcc Free Online fedotracker Free Online greensnow Free Online h3xtracker Free Online hphosts for malware Free Online iblocklist Free Online ibmxforce Free Online intercept.sh Free Online intercept.sh Free Online malc0de Free Online malware_traffic Free Online malwared.malwaremustdie.org Free Online malwared.malwaremustdie.org Free Online Source Name Subscription Status
BAD PACKETS CYBER THREAT INTELLIGENCE - EXAMPLE
STATIC MALWARE ANALYSIS DIE Free Windows, Linux, Mac Os Name Version Paltform PE Bear Free Windows PortEx Free Windows Manalyze Free Windows PE Studio Free Windows Mastiff Free Windows Exeinfo PE Free Windows CFF Explorer Free Windows PE Tools Free Windows FileAlyzer Free Windows PE Explorer Free Windows PE Insider Free Windows PE View Free Windows Chimprec Free Windows PEID Free Windows
REVERSE ENGINEERING Name Version Paltform IDA Paid Windows Ghidra Free Windows, Linux, Mac Os Cutter Free Windows Radare Free Linux
DYNAMIC MALWARE ANALYSIS
CODE EXECUTE?
CODE EXECUTE COMMAND!
SYSTEM CHECK
PERSISTENCE!
OS NAME!
ANTI DEBUGGING!
ENCODING? DeObfuscation ALFA SHELL V3 : https://github.com/raminfp/DeObfuscation_ALFA_SHELL_V3
WIN API
CHECK UP INTERNET
YOUTUBE CHANNEL FOR MALWARE ANALYSIS YouTube Channel Name OALabs Kindred Security Colin Hardy MalwareAnalysisForHedgehogs Michael Gillespie ReverseIT LiveOverflow hasherezade John Hammond MalwareTech RSA Conferenc Monnappa K A
DOCUMENT ANALYSIS – PDF / WORD / EXCEL Name Version Paltform Ole Tool Free Python Didier's PDF Tools Free Python Origami Free Ruby REMnux Free Virtual Machine PDF Free Binary ViperMonkey Free Python
MALWARE REPORT TECHNICAL • Summery – If (Init Access) – Category (Ransome, Rootkit, Bootkit) • File Metadata Information – Filename – MD5 Hash – File Type – File Size – SHA256 – PE Information / File less • Static Analysis – Domain / IP – Obfuscation and Encryption – Anti Reverse / Anti Sandbox • Dynamic Analysis – Execution – Connection to C&C – Logs – Traffic – YARA rule Reports : https://isc.sans.edu/diary/26750 https://isc.sans.edu/diary/26744 https://us-cert.cisa.gov/ncas/alerts/aa20-302a
WEAKNESSES CERT.IR / AFTA • Very bad style report • Ant activity in social media network • Ant activity in github • There isn’t content for cyber security • Copy & Paste news
SOLUTION • Activity in twitter • Activity in Github repo Open Source ( YARA ) • “Infrastructure Bug Bounty” (IBB) • Own Researching (Cafebazaar / p30download / soft98) • Publish on tools in Malware Analysis
HOW TO WORK WITH OTHER RESEARCHER? EXAMPLE
SHOULD FOLLOWING IN TWITTER • https://twitter.com/executemalware • https://twitter.com/malware_traffic • https://twitter.com/JRoosen • https://twitter.com/HONKONE_K • https://twitter.com/3xp0rtblog • https://twitter.com/mal_share • https://twitter.com/RedDrip7 • https://twitter.com/Arkbird_SOLG • https://twitter.com/MalwarePatrol • https://twitter.com/DidierStevens • https://twitter.com/CyberIOCs • https://twitter.com/DissectMalware • https://twitter.com/MITREattack • https://twitter.com/Ledtech3 • https://twitter.com/VK_Intel
THE END •Question?

More Related Content

PPTX
Network Penetration Testing
byMohammed Adam
 
PDF
Threat Hunting Procedures and Measurement Matrice
byVishal Kumar
 
PDF
MITRE ATT&CK Framework
byn|u - The Open Security Community
 
PDF
Threat-Based Adversary Emulation with MITRE ATT&CK
byKatie Nickels
 
PDF
Building an InfoSec RedTeam
byDan Vasile
 
PDF
Azure Penetration Testing
byCheah Eng Soon
 
PDF
Metaploit
byAjinkya Pathak
 
PDF
Threat Hunting
bySplunk
 
Network Penetration Testing
byMohammed Adam
 
Threat Hunting Procedures and Measurement Matrice
byVishal Kumar
 
MITRE ATT&CK Framework
byn|u - The Open Security Community
 
Threat-Based Adversary Emulation with MITRE ATT&CK
byKatie Nickels
 
Building an InfoSec RedTeam
byDan Vasile
 
Azure Penetration Testing
byCheah Eng Soon
 
Metaploit
byAjinkya Pathak
 
Threat Hunting
bySplunk
 

What's hot

PPTX
Penetration testing reporting and methodology
byRashad Aliyev
 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
PPTX
Introduction To Exploitation & Metasploit
byRaghav Bisht
 
PDF
Cyber Threat hunting workshop
byArpan Raval
 
PPTX
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
PDF
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
byJorge Orchilles
 
PPTX
Vulnerability assessment and penetration testing
byAbu Sadat Mohammed Yasin
 
PDF
Application Security | Application Security Tutorial | Cyber Security Certifi...
byEdureka!
 
PDF
Threat Hunting with Splunk Hands-on
bySplunk
 
PPTX
System hacking
byCAS
 
PPTX
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
PPTX
Threat hunting - Every day is hunting season
byBen Boyd
 
PPTX
Web Application Penetration Testing Introduction
bygbud7
 
PDF
Red Team Framework
by👀 Joe Gray
 
PPTX
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
byAdam Pennington
 
PDF
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
PPTX
Vulnerability assessment & Penetration testing Basics
byMohammed Adam
 
PPTX
Threat hunting in cyber world
byAkash Sarode
 
PDF
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
byMITRE ATT&CK
 
PPTX
WTF is Penetration Testing v.2
byScott Sutherland
 
Penetration testing reporting and methodology
byRashad Aliyev
 
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
Introduction To Exploitation & Metasploit
byRaghav Bisht
 
Cyber Threat hunting workshop
byArpan Raval
 
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
byJorge Orchilles
 
Vulnerability assessment and penetration testing
byAbu Sadat Mohammed Yasin
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
byEdureka!
 
Threat Hunting with Splunk Hands-on
bySplunk
 
System hacking
byCAS
 
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
Threat hunting - Every day is hunting season
byBen Boyd
 
Web Application Penetration Testing Introduction
bygbud7
 
Red Team Framework
by👀 Joe Gray
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
byAdam Pennington
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
Vulnerability assessment & Penetration testing Basics
byMohammed Adam
 
Threat hunting in cyber world
byAkash Sarode
 
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
byMITRE ATT&CK
 
WTF is Penetration Testing v.2
byScott Sutherland
 

Similar to Malware Analysis

PDF
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
PDF
Practical Incident Response - Work Guide
byEduardo Chavarro
 
PPTX
Malware Analysis 101: N00b to Ninja in 60 Minutes at BSidesDC on October 19, ...
bygrecsl
 
PPTX
Dynamic malware Analysis with samples & tool
byGuna Dhondwad
 
PDF
'Malware Analysis' by PP Singh
byBipin Upadhyay
 
PDF
Malware Analysis -an overview by PP Singh
byn|u - The Open Security Community
 
PDF
Modern Malware and Threats
byMarketingArrowECS_CZ
 
PDF
Modern malware and threats
byMartin Holovský
 
PPTX
BSIDES-PR Keynote Hunting for Bad Guys
byJoff Thyer
 
PPTX
Malware Analysis 101 - N00b to Ninja in 60 Minutes at CactusCon on April 4, 2014
bygrecsl
 
PPTX
malware analysis
by20CS201AkashR
 
PDF
H@dfex 2015 malware analysis
byCharles Lim
 
PPTX
ANALYZE'15 - Bulk Malware Analysis at Scale
byJohn Bambenek
 
PDF
4 Getting Started & 5 Leads
bySam Bowne
 
PDF
Incident Response & Malware Analysis Protecting the Digital Frontier
byvarnika2764
 
PDF
Malware
bySetiya Nugroho
 
PDF
Threat Hunting by Falgun Rathod - Cyber Octet Private Limited
byFalgun Rathod
 
PPTX
Threat hunting for Beginners
bySKMohamedKasim
 
PDF
EXTERNAL - Whitepaper - How 3 Cyber ThreatsTransform Incident Response 081516
byYasser Mohammed
 
PDF
CNIT 121: 2 IR Management Handbook
bySam Bowne
 
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
Practical Incident Response - Work Guide
byEduardo Chavarro
 
Malware Analysis 101: N00b to Ninja in 60 Minutes at BSidesDC on October 19, ...
bygrecsl
 
Dynamic malware Analysis with samples & tool
byGuna Dhondwad
 
'Malware Analysis' by PP Singh
byBipin Upadhyay
 
Malware Analysis -an overview by PP Singh
byn|u - The Open Security Community
 
Modern Malware and Threats
byMarketingArrowECS_CZ
 
Modern malware and threats
byMartin Holovský
 
BSIDES-PR Keynote Hunting for Bad Guys
byJoff Thyer
 
Malware Analysis 101 - N00b to Ninja in 60 Minutes at CactusCon on April 4, 2014
bygrecsl
 
malware analysis
by20CS201AkashR
 
H@dfex 2015 malware analysis
byCharles Lim
 
ANALYZE'15 - Bulk Malware Analysis at Scale
byJohn Bambenek
 
4 Getting Started & 5 Leads
bySam Bowne
 
Incident Response & Malware Analysis Protecting the Digital Frontier
byvarnika2764
 
Malware
bySetiya Nugroho
 
Threat Hunting by Falgun Rathod - Cyber Octet Private Limited
byFalgun Rathod
 
Threat hunting for Beginners
bySKMohamedKasim
 
EXTERNAL - Whitepaper - How 3 Cyber ThreatsTransform Incident Response 081516
byYasser Mohammed
 
CNIT 121: 2 IR Management Handbook
bySam Bowne
 

More from Ramin Farajpour Cami

PDF
Combining AI with Red Teaming and Bug Bounty
byRamin Farajpour Cami
 
PPTX
How to assign a CVE to yourself?
byRamin Farajpour Cami
 
PPTX
Bug bounty
byRamin Farajpour Cami
 
PDF
Linux kernel booting
byRamin Farajpour Cami
 
PPTX
Make own you kernel os
byRamin Farajpour Cami
 
PPTX
Linux kernel system call
byRamin Farajpour Cami
 
PPTX
Linux kernel development
byRamin Farajpour Cami
 
Combining AI with Red Teaming and Bug Bounty
byRamin Farajpour Cami
 
How to assign a CVE to yourself?
byRamin Farajpour Cami
 
Bug bounty
byRamin Farajpour Cami
 
Linux kernel booting
byRamin Farajpour Cami
 
Make own you kernel os
byRamin Farajpour Cami
 
Linux kernel system call
byRamin Farajpour Cami
 
Linux kernel development
byRamin Farajpour Cami
 

Recently uploaded

PDF
From Hallucinations to High-Confidence AI with Data Enrichment.pdf
byPrecisely
 
PPTX
Introducing VisualSim 2610 The Next Leap in System Level Modeling
byDeepak Shankar
 
PPTX
apidays Paris 2025 | Building Agentic Workflows
byapidays
 
PDF
How AI Can Help Platform Engineers Build Better Platforms
byAll Things Open
 
PPTX
Celonis Optimizing your future with process
bydevjeremyappleyard
 
PDF
20260212 Security-JAWS activity results for 2025 and activity goals for 2026
byTyphon 666
 
PDF
HOW TO OVERCOME THE THREATS OF ARTIFICIAL INTELLIGENCE AGAINST HUMANITY.pdf
byFaga1939
 
PPTX
CTO Strategy OS 2026: The Tech, AI & Cloud Playbook Boards Want
byridwansassman
 
PDF
From Artificial Intelligence to African Intelligence: Transforming Research &...
byMoses Kemibaro
 
PDF
Effortless Distributed Systems with Aspire.pdf
byParticular Software
 
PPTX
Do You Control the AI, or Does the AI Control You?
bymedhateltoukhy
 
PDF
Spec-Driven Development with Kiro: Elevating Software Quality, Traceability, ...
byHaim Michael
 
PDF
Chapter 5 Security Mechanisms iin computer security.pdf
byGetnet Tigabie Askale -(GM)
 
PDF
TrustArc Webinar - From Trends to Action: Fitting AI Governance into Privacy Ops
byTrustArc
 
PDF
Preserve workload integrity during cross-architecture migration
byPrincipled Technologies
 
PDF
GenerationAI_Paris_2025_Architecting_Intelligence.pdf
byapidays
 
PDF
NTG -Company Profile_Software_Vendor_Company_in_MENA
byMustafa Kuğu
 
PDF
apidays Paris 2025 | Zero Trust By Design
byapidays
 
PDF
How does MES(Manufacturing Execution System) work?
byakipii ogaoga
 
PDF
Empower your IT team with cloud-based PC management using Dell Management Por...
byPrincipled Technologies
 
From Hallucinations to High-Confidence AI with Data Enrichment.pdf
byPrecisely
 
Introducing VisualSim 2610 The Next Leap in System Level Modeling
byDeepak Shankar
 
apidays Paris 2025 | Building Agentic Workflows
byapidays
 
How AI Can Help Platform Engineers Build Better Platforms
byAll Things Open
 
Celonis Optimizing your future with process
bydevjeremyappleyard
 
20260212 Security-JAWS activity results for 2025 and activity goals for 2026
byTyphon 666
 
HOW TO OVERCOME THE THREATS OF ARTIFICIAL INTELLIGENCE AGAINST HUMANITY.pdf
byFaga1939
 
CTO Strategy OS 2026: The Tech, AI & Cloud Playbook Boards Want
byridwansassman
 
From Artificial Intelligence to African Intelligence: Transforming Research &...
byMoses Kemibaro
 
Effortless Distributed Systems with Aspire.pdf
byParticular Software
 
Do You Control the AI, or Does the AI Control You?
bymedhateltoukhy
 
Spec-Driven Development with Kiro: Elevating Software Quality, Traceability, ...
byHaim Michael
 
Chapter 5 Security Mechanisms iin computer security.pdf
byGetnet Tigabie Askale -(GM)
 
TrustArc Webinar - From Trends to Action: Fitting AI Governance into Privacy Ops
byTrustArc
 
Preserve workload integrity during cross-architecture migration
byPrincipled Technologies
 
GenerationAI_Paris_2025_Architecting_Intelligence.pdf
byapidays
 
NTG -Company Profile_Software_Vendor_Company_in_MENA
byMustafa Kuğu
 
apidays Paris 2025 | Zero Trust By Design
byapidays
 
How does MES(Manufacturing Execution System) work?
byakipii ogaoga
 
Empower your IT team with cloud-based PC management using Dell Management Por...
byPrincipled Technologies
 

Malware Analysis

  • 1.
    R A MI N FA R A J P O U R C A M I T W I T T E R : M F 4 R R 3 L L G I T H U B : @ R A M I N F P Malware Analysis
  • 3.
    METHODOLOGY FOR HANDLINGSECURITY INCIDENTS, BREACHES, AND CYBER THREATS • 1] Threat Hunting • 2] Malware Analysis • 3] Incident Response • 4] Threat Intelligence
  • 4.
    WHAT IS THREATHUNTING? • The process of proactively and iterative searching through networks to detect and isolate advanced threats that evade existing security solutions. – Analysis track – Intercept – Eliminate adversaries lurking in a network – Tools : SIEM, IDS, Firewall • Video : https://www.exabeam.com/product/exabeam-threat-hunter/
  • 5.
    THREAT HUNTER SKILLS •Data analytics and reporting skills — these include pattern recognition, technical writing, data science, problem solving and research. • Operating systems and networks knowledge — needs to know the ins and outs of the organizational systems and network. • Information security experience — including malware reverse engineering, adversary tracking and endpoint security. A threat hunter needs to have a clear understanding past and current tactics, techniques and procedures (TTPs) used by the attackers. • Programming language — at least one scripting language and one compiled language is common, though modern tools are increasingly eliminating the need for using scripting language.
  • 6.
    THREAT HUNTING REFERENCE NameDescription Attack&Ck Website for Information related to Hunting Techniques. The ThreatHunting Project Website for Information to start Threat HUNTPEDIA A very handfull book.
  • 7.
    THREAT HUNTING TOOLS NameVersion Description ELK Free A platform which help to create usecasses for threat huntng and hypothesis. Sysmon Free System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. Osquery Free Performant endpoint visibility, Supoort all OS platform.
  • 8.
    ELK • Beats -https://github.com/elastic/beats – Docs : https://github.com/elastic/beats#documentation-and-getting-started • ElasticSearch - https://www.elastic.co/elasticsearch/ • Logstash - https://github.com/elastic/logstash • Kibana - https://www.elastic.co/kibana/
  • 9.
    WHAT IS MALWAREANALYSIS ? • The process of understanding the behavior and purpose of a suspicious file or URL. The output of the analysis aids in the detection and mitigation of the potential threat – Malware investigation – Malware performance – The purpose of the malware – Malicious level of malware – Traffic analysis sent – How to connect to the server – Malware code structure – IOC with YARA/Snort • Malware analysis is that it helps Incident Responders (IR) and security analysts (ALERT)
  • 10.
    MALWARE ANALYSIS SKILLS •Networking • IOC (indicator Analysis)  YARA / Snort • Static Analysis • Dynamic Analysis • Memory Forensics • RE (Reverse Engineering) • File Format • OS Internal • Coding / Script
  • 11.
    WHAT IS INCIDENTRESPONSE ? • Structured approach to handle various types of security incidents, cyber threats, and data breaches. • The incident response methodology aims to identify, contain, and minimize the cost of a cyberattack or a live incident. • Why Is Incident Response Important? – Data breaches cost companie’s operational downtime, reputational, and financial loss. – For most of the organizations, breaches lead to devaluation of stock value and loss of customer trust. – To eliminate such risks, companies need a well-planned cybersecurity incident response plan, • https://youtu.be/NIKIJodcxOk
  • 12.
    GRAPHITE – GRAFANA- DIAMOND • https://graphiteapp.org/ • https://github.com/grafana/grafana • Or https://github.com/prometheus/prometheus • https://github.com/python-diamond/Diamond Installing : https://github.com/SecurityTalks/Malware-Analysis
  • 13.
    WHAT ARE THECOMMON TYPES OF INCIDENTS?
  • 14.
    WHAT IS THREATINTELLIGENCE? • Cyber threat information becomes once it has been collected, evaluated in the context of its source and reliability, and analyzed • It requires that analysts identify similarities and differences in vast quantities of information and detect deceptions to produce accurate, timely, and relevant intelligence.
  • 15.
    THREAT INTELLIGENCE RESOURCE dydnsFree Online emergingthreats for botcc Free Online fedotracker Free Online greensnow Free Online h3xtracker Free Online hphosts for malware Free Online iblocklist Free Online ibmxforce Free Online intercept.sh Free Online intercept.sh Free Online malc0de Free Online malware_traffic Free Online malwared.malwaremustdie.org Free Online malwared.malwaremustdie.org Free Online Source Name Subscription Status
  • 16.
    BAD PACKETS CYBERTHREAT INTELLIGENCE - EXAMPLE
  • 17.
    STATIC MALWARE ANALYSIS DIEFree Windows, Linux, Mac Os Name Version Paltform PE Bear Free Windows PortEx Free Windows Manalyze Free Windows PE Studio Free Windows Mastiff Free Windows Exeinfo PE Free Windows CFF Explorer Free Windows PE Tools Free Windows FileAlyzer Free Windows PE Explorer Free Windows PE Insider Free Windows PE View Free Windows Chimprec Free Windows PEID Free Windows
  • 20.
    REVERSE ENGINEERING Name VersionPaltform IDA Paid Windows Ghidra Free Windows, Linux, Mac Os Cutter Free Windows Radare Free Linux
  • 21.
  • 24.
  • 25.
  • 26.
  • 27.
  • 28.
  • 29.
  • 30.
    ENCODING? DeObfuscation ALFA SHELLV3 : https://github.com/raminfp/DeObfuscation_ALFA_SHELL_V3
  • 31.
  • 32.
  • 33.
    YOUTUBE CHANNEL FORMALWARE ANALYSIS YouTube Channel Name OALabs Kindred Security Colin Hardy MalwareAnalysisForHedgehogs Michael Gillespie ReverseIT LiveOverflow hasherezade John Hammond MalwareTech RSA Conferenc Monnappa K A
  • 34.
    DOCUMENT ANALYSIS –PDF / WORD / EXCEL Name Version Paltform Ole Tool Free Python Didier's PDF Tools Free Python Origami Free Ruby REMnux Free Virtual Machine PDF Free Binary ViperMonkey Free Python
  • 35.
    MALWARE REPORT TECHNICAL •Summery – If (Init Access) – Category (Ransome, Rootkit, Bootkit) • File Metadata Information – Filename – MD5 Hash – File Type – File Size – SHA256 – PE Information / File less • Static Analysis – Domain / IP – Obfuscation and Encryption – Anti Reverse / Anti Sandbox • Dynamic Analysis – Execution – Connection to C&C – Logs – Traffic – YARA rule Reports : https://isc.sans.edu/diary/26750 https://isc.sans.edu/diary/26744 https://us-cert.cisa.gov/ncas/alerts/aa20-302a
  • 36.
    WEAKNESSES CERT.IR /AFTA • Very bad style report • Ant activity in social media network • Ant activity in github • There isn’t content for cyber security • Copy & Paste news
  • 37.
    SOLUTION • Activity intwitter • Activity in Github repo Open Source ( YARA ) • “Infrastructure Bug Bounty” (IBB) • Own Researching (Cafebazaar / p30download / soft98) • Publish on tools in Malware Analysis
  • 38.
    HOW TO WORKWITH OTHER RESEARCHER? EXAMPLE
  • 39.
    SHOULD FOLLOWING INTWITTER • https://twitter.com/executemalware • https://twitter.com/malware_traffic • https://twitter.com/JRoosen • https://twitter.com/HONKONE_K • https://twitter.com/3xp0rtblog • https://twitter.com/mal_share • https://twitter.com/RedDrip7 • https://twitter.com/Arkbird_SOLG • https://twitter.com/MalwarePatrol • https://twitter.com/DidierStevens • https://twitter.com/CyberIOCs • https://twitter.com/DissectMalware • https://twitter.com/MITREattack • https://twitter.com/Ledtech3 • https://twitter.com/VK_Intel
  • 40.