This course on current malware analysis aims to teach learners how to analyze and dissect recent malware threats. The course covers various topics such as extracting files from PCAP, setting up analysis tools like Ghidra and Cuckoo Sandbox, unpacking malware using different tools, analyzing malicious documents, and debugging JavaScript. The course is designed for individuals interested in cybersecurity, malware analysis, and digital forensics. The teaching method includes video tutorials and practical demonstrations to enhance understanding and application of malware analysis techniques.
Overview
Syllabus
How-To: Making a Protected VBA Project Viewable with EvilClippy.
Extracting ZIP files from PCAP with Wireshhark & NetworkMiner, plus analysis with CyberChef.
How-To: Installing Oledump in Windows.
Creating an IDA Python Plugin for Static XOR String Deobfuscation.
[11/10/2020] Emotet Maldoc Analysis - Embedded DLL and CertUtil for Base64 Decoding.
Using Ghidra to Statically XOR Obfuscated Shellcode.
Webinar - Installing and Configuring Suricata with Cuckoo Sandbox (04/02/2020).
Setting Up Cuckoo Sandbox v2.0.7 on Ubuntu 18.04.4 - Part 2.
Setting up Cuckoo Sandbox v2.0.7 on Ubuntu 18.04.4 - Part 1.
Unpacking a Trojan with Ghidra and x64dbg.
Getting Started with Ghidra: Analyzing Process Hollowing Shellcode from a Maldoc.
Unpacking Malware that uses AutoIt.
Using Visual Studio to Debug JavaScript via Windows Script Host (WSH).
Excel document uses external data connection for next stage payload.
Finding Macro Content in a Spreadsheet Cell.
Analyzing Macros with the Office IDE.
Macro analysis on an Emotet dropper (office document) from 01/17/2020.
Taught by
Josh Stroschein
