Malware Analysis Topics - Malware Design

Malware techniques used to perform malicious actions are often similar to those used by antivirus and security products. Understanding how to write and design malware can help security analysts rapidly identify patterns of code when investigating a malicious binary.

Knowing how to design and develop each part of a payload can enable red team members to reuse, debug, fix, or rewrite a solution.

Students can learn how to produce a shellcode blob capable of loading and injecting multiple malicious binaries using techniques repurposed from existing malicious samples. This course includes APIs and techniques used to perform common malicious functionality and extends these techniques to produce reliable payloads that function across operating system versions and limit exposure to security products.

The hands-on labs for this course are development-focused through use of C and Intel Assembly.

Prerequisites: Advanced knowledge of computer and operating system fundamentals and windows internals. Familiarity with reverse engineering, Windows SDK, and proficiency at developing in C is recommended.

After completing this course, learners should be able to:

• Develop malicious applications using the Windows SDK
• Create position independent code (PIC) using C and Intel Assembly
• Write malicious code to perform code injection and modify a running application in-memory
• Analyze and modify a malicious binary to reuse functionality
• Design and write reliable payloads across a variety of operating system versions
• Use proven techniques to execute injections, hooking, and fingerprinting across various systems

Software developers, information security professionals, incident responders, computer security researchers, corporate investigators, and others who require an understanding of malware inner workings, crafting reliable shellcode and payloads, and rapid repurposing of malware samples.

In-classroom instructor-led training

5 days

Students are required to bring their own laptop that meets the following specs:

• VirtualBox 7+
• At least 30 GB of free HDD space