Uploaded bylior mazor
The Power of Malware Analysis and Development.pdf
The document discusses malware analysis and development, highlighting their importance for improving offensive and defensive cybersecurity skills. It emphasizes learning from existing malware samples and understanding operating system internals to become more effective in red teaming and detection engineering. Additionally, it promotes a training academy offering courses in malware development with a discount for participants.
More Related Content
Similar to The Power of Malware Analysis and Development.pdf
The Power of Malware Analysis and Development.pdf
- 1. The Power ofMalware Analysis and Development Uriel Kosayev - @MalFuzzer Pavel Yosifovich - @Zodiacon
- 2. Uriel Kosayev Book Author Founderof CYMDALL Founder of TrainSec.net Malware Researcher Red Teamer Trainer & Speaker Twitter Handle: @MalFuzzer
- 3. Pavel Yosifovich Books Author Founderof CYMDALL Founder of TrainSec.net Developer Trainer & Speaker Twitter Handle: @Zodiacon
- 4. What is MalwareAnalysis?
- 5. The art ofresearch and analysis of malicious software behavior and patterns.
- 6. Static Analysis Automated Analysis DynamicAnalysis Reverse Engineering Harder
- 7. What is MalwareDevelopment?
- 8. The practice ofdeveloping code for malicious purposes
- 9. Only for Maliciouspurposes?!
- 10. Of course not! Malwaredevelopment can be legitimate, of course depending on the purpose
- 11. The Malware DevelopmentLife-Cycle (MDLC)
- 12.
- 13. Why Learn MalwareDevelopment?
- 14. To know howmalware is written To have better offensive and defensive skills Become a better Red Teamer and Detection Engineer Better understanding of your OS Internals Better understanding of OS API Functions Because real Hackers know their shi*, so know your shi*!
- 16. “The one whoposses the skills and knowledge to understand and practically apply things, has the power to rule them all” - Anonymous Philosopher
- 17. So why doyou even care?
- 18. Because the badguys do!
- 19. Threat actors evolveby learning and leveraging the craft and TTPs by researching malware samples in the wild. So why cannot the good guys do so?
- 20. You do nothave to develop your malware from zero Learn from real-world malware samples and incidents
- 21. DarkSide Ransomware Seek& Hide Runtime Code Decryption & Dynamic API Resolve
- 22. No functions inthe IAT!
- 24.
- 26.
- 28.
- 30. And Voila! Runtime builtIAT for you
- 32. Developing Windows Malware Nodifferent than any kind of low-level Windows development Uses Windows APIs (documented or not so much) Built with standard tools and compilers (e.g., Visual Studio) Testing is paramount Debugging
- 33. Windows Subsystem APIs •Windows API (“Win32”) • Classic C API from the first days of Windows NT • Some APIs are COM based • Especially in newer (Vista+) APIs • Examples: BITS, DirectX, WIC, DirectShow, Media Foundation • .NET • Managed libraries running on top of the CLR • Common languages: C#, VB.NET, F#, C++/CLI • Windows Runtime (WinRT) • New unmanaged API available for Windows 8+ • Built on top of an enhanced version of COM 33
- 34. PEB, TEBs VirtualAlloc allocated memory ProcessVirtual Memory Map MyApp.exe NtDll.dll KernelBase.dll AdvApi32.dll Thread 1 Stack Other heaps 0 Default Process Heap Thread 2 Stack Kernel32.dll 2GB/4GB/8TB/128TB 34
- 35. Function Call FlowExample 35 call ReadFile Msvcrt.dll call NtReadFile sysenter / syscall Kernel32.DLL NtDll.DLL call NtReadFile NtOskrnl.EXE NtReadFile: call driver NtOskrnl.EXE Initiate I/O return to caller driver.sys call fread application User mode Kernel mode
- 36. Time for SomeMalware Development!
- 37. TrainSec Academy Where prostrain pros Advanced Security and Programming Training https://TrainSec.net
- 38. Only for youfolks! 20% Discount Code for the upcoming Malware Development Workshop! Coupon Code: MALDEVISTHEBEST Click here to redeem your coupon and get the chance to become a Malware Developer!
- 39.