Home

Awesome

Malware Analysis - CSCI 4976

This repository contains the materials as developed and used by RPISEC to teach Malware Analysis at Rensselaer Polytechnic Institute in Fall 2015. This was a university course developed and run soley by students, primarily using the Practical Malware Analysis book by Michael Sikorski and Andrew Honig, to teach skills in reverse engineering, malicious behaviour, malware, and anti-analysis techniques.

<p align="center"> <img width="700px" src="/resources/images/class.png" alt="Malware"/> </p>

About the Course

The Practical Malware Analysis (PMA) book is where many RPISEC members and alumn started. The book reads very well, is full of information, and the lab walkthroughs in the back are invaluable. We didn't want to re-invent the wheel so we structured most of the class around the book. Students were expected to have read the relevant PMA book chapters before class, allowing us to spend much more class time demonstrating skills and techniques and walking through hands-on examples with the students.

Syllabus: http://security.cs.rpi.edu/courses/malware-fall2015/Syllabus.pdf

Note: Most of the samples used in this course are malicious in nature, treat them carefully!

To help protect people from accidentaly running samples on an important machine, and to prevent anti-malware suites from blocking the course material, all of the samples are compressed and encrypted with a password of 'infected'.

Course Abstract

With the increased use of the Internet and prevalence of computing systems in critical infrastructure, technology is undoubtedly a vital part of modern daily life. Unfortunately, the increasingly networked nature of the modern world has also enabled the spread of malicious software, or “malware”, ranging from annoying adware to advanced nation-state sponsored cyber-weaponry. As a result, the ability to detect, analyze, understand, control, and eradicate malware is an increasingly important issue of economic and national security.

This course will introduce students to modern malware analysis techniques through readings and hands-on interactive analysis of real-world samples. After taking this course students will be equipped with the skills to analyze advanced contemporary malware using both static and dynamic analysis.

Prerequisite Knowledge

This course carried a prereq of Computer Organization - CSCI 2500 at RPI. Computer Organization is RPI's basic computer architecture course that teaches things like C, MIPS assembly, x86 assembly, Datapaths, CPU Pipelining, CPU Caching, Memory Mapping, etc.

Our expected demographic for Malware Analysis was students with zero reverse engineering experience. That said, to be able to take this course you will probably need at least the following skills.

Lecture Breakdown

LectureTitleTopics
01IntroductionSyllabus, Basic Static Analysis, Basic Dynamic Analysis
02Advanced Static Analysisx86, IDA, Code Constructs
03Analyzing Windows ProgramsWinAPI, Handles, Windows Internals, Networking, COM
04Advanced Dynamic AnalysisDebugging Concepts and Tools
05Malware BehaviorMalicious Activities and Techniques
06Data Encoding and Malware CountermeasuresHiding Data, Malware Countermeasures
07Covert Malware LaunchingCovert Launching and Execution
08Anti-AnalysisAnti-Disassembly, Anti-VM, Anti-Debugging, Anti-AV
09Packing and UnpackingPackers, Packing, and Unpacking
10Intro to Windows KernelKernel Basics, Windows Kernel API, Windows Drivers, Kernel Debugging
11Rootkit TechniquesHooking, Patching, Direct Kernel Object Manipulation
12Rootkit Anti-Forensics and Covert ChannelsAnti-forensics, Covert Channels

Lab Breakdown

LabTopic
01Basic Analysis
02Advanced Static Analysis
03Analyzing Windows Programs
04Advanced Dynamic Analysis
05Malware Behavior
06Data Encoding and Malware Countermeasures
07Covert Malware Launching
08Anti Analysis
09Packing and Unpacking
10Windows Kernel

Project Breakdown

ProjectTopic
01Malware Behavior
02Runtime Process Manipulation
03Unpacking and Automation
04APT Sample Analysis

Links for additional exercises:

Analysis Environment

Setting up a "safe" and usable analysis environment can range from easy to impossible, depending on how far you want to go. The PMA book devotes an entire chapter (Chapter 2) to this problem. For the purposes of this class, we decided to set up a Windows 7 32-bit virtual machine. Unfortunately, while all the software we used for the class is free, Windows is not, thus we cannot distribute this VM like we distributed the Warzone for MBE. We have, however, included a comprehensive list, and a collection of installers, of all the tools we used throughout the course. There are a few "essentials" that we haven't listed but are still included in the installer package (python, cygwin, etc).

Visit the releases page for the latest package.

Tools

Frequently Asked Questions

If you are ever stuck on a problem or have any questions, you're more than welcome to ask on IRC.

What is the password to the zip files?

'infected', no quotes.

Are these files malicious/dangerous?

Yes. Not all of them are malicious in nature, but most are. Always keep them inside a proper analysis environment.

Why are the lecture slides for XYZ so sparse?

Much of lecture time was spent in hands on examples, with the expectation that students had read the material in the PMA book ahead of time. Thus the slide content referring to material from the PMA book is meant as more of an outline. Read the chapters and then go through the lab walkthroughs in the back of the PMA book, they are a great resource.

Do you have videos of the lectures?

Sadly we did not record any of the lectures, maybe next time.

Where can I learn more?

Play more wargames:

Reverse more samples:

The following books are excellent resources for expanding your knowledge of malware analysis and reverse engineering. We recommend working through them in the following order:

These three books are also excellent:

And when they're happening, play CTFs!

<a name="contact"></a>I have a question, how can I get in touch with you?

Our club keeps a pretty active IRC presence. Someone there can probably answer your question.

Server: irc.rpis.ec Port: 6667, or 6697 (SSL)

If you would like a more formal means of communication, you can reach us at contact [at] rpis.ec

Licensing

This course was explicitly designed for academic & educational use only. Please keep this in mind when sharing and distributing our course material. The specific licenses involved can be found below.

Lecture Slides

The lectures are covered by the Creative Commons Attribution-NonCommercial 4.0 International license CC BY-NC 4.0.

<p align="center"> <a href="https://creativecommons.org/licenses/by-nc/4.0/"><img src="/resources/images/cc-by-nc.png" alt="CC BY-NC 4.0"/></a> </p>

Acknowledgements

Hundreds of hours and countless all nighters went into the production and execution of this course. This section serves to recognize those who made all of this possible.

Original Authors

Special Thanks