This course will teach you how to reverse engineer malware using battle-tested techniques and tactics. The full range of critical reverse engineering approaches is covered. You will be fully capable of dissecting advanced malware samples to support incident response and threat intelligence activities once certified.

"To understand malware, you have to think like an attacker. You have to understand how they operate, how they think, and what they're trying to accomplish. That's why reverse engineering is such a powerful tool in the fight against cyber-attacks. It allows us to see the world through the eyes of the enemy."

Reverse engineering is a process that is used to analyze and understand the inner workings of a software program or system. This process can be used to identify and fix security vulnerabilities, as well as to develop countermeasures against cyber-threat actors. By understanding how an attacker may attempt to exploit a system, organizations can take steps to secure their assets.

There are a number of tools and techniques that can be used for reverse engineering, including disassembling, decompiling, and debugging. In order to effectively reverse engineer a program, it is important to have a good understanding of how the program is structured and how it functions. This can be achieved through experience and practice, as well as by studying the program's code and available documentation.

MCSI MRE is the best course to learn software reverse engineering because it offers an in-depth, hands-on learning experience. The course is designed for students who want to become experts in reverse engineering software applications. Students will learn how to analyze and understand the inner workings of software applications, and how to create tools and techniques to disassemble, decompile, and reconstruct software.

The MCSI Reverse Engineering (MRE) certification will equip you with the skillset necessary to carry out the following tasks:

• Employ a systematic approach to malware analysis
• Perform static, dynamic and behavioral analysis
• Deobfuscate protected malware samples
• Manually decompile binaries back to C code
• Produce descriptions of how APT samples work
• Develop high-fidelity indicators of compromise (IOCs)

A malware analyst typically earns an annual salary of $70,000. However, with experience and expertise in this field, a malware analyst can earn up to $150,000 per year.

MCSI is one of the most respected and trusted names in cyber security education and training. Our certifications teach critical skills, knowledge and abilities needed to advance a career in cyber security. Our courses are comprehensive and up-to-date, and our instructors are experienced professionals who are dedicated to helping students learn. MCSI provides the real-world skills and knowledge you need to protect any organization from cyber threats.

• Employ a systematic approach to malware analysis
• Binary Classification

  Binary classification is the process of identifying a malware sample as being malicious or benign. It is a critical step in the reverse engineering process, as it allows analysts to focus on the more important tasks of understanding the malware's functionality and how it operates.

  PE format

  The Portable Executable (PE) format is the file format of executables, object code, and Dynamic Link Libraries (DLLs) in Microsoft Windows. It is a common standard across all versions of the Windows operating system.

  The PE format is composed of several headers and sections. The most important section is the executable header, which contains information about the image such as its size, entry point, and machine type. Sections contain data or resources that are loaded into memory when the image is executed.

  Classifying executables based on PE properties

  When you reverse engineer a binary, one of the first things you'll want to do is figure out what kind of executable it is. This is important because each type of executable has its own unique properties. In this post, we'll take a look at how to classify executables based on their PE properties.

  Writing automated scripts to scale parsing executable files

  The automation of parsing executable files in reverse engineering is important to scale the analysis of these files. Automation allows for the execution of scripts that can rapidly identify meaningful data in a large number of files. This is important as it allows for the identification of patterns and trends that may exist in a set of files. Automated parsing also allows for the identification of changes that may have occurred in a set of files, which can help in the identification of malware.

  Binary decomposition

  There are a few different ways to approach reverse engineering a binary. One common method is to break the binary down into its component parts and resources, and then analyse each one separately. This process is known as binary decomposition.

  This approach can be helpful when trying to understand how a binary works, or when trying to find specific pieces of information within the binary. It can also be used to identify malware or other malicious content.

  Developing YARA rules to detect known samples

  Developing YARA rules to detect known malware samples is an important step in protecting networks. YARA is a tool that enables you to create rules to detect malicious files. By creating rules that target known malware samples, you can quickly and easily identify these files on your system and take appropriate action.

• Behavioral Analysis

  A behavioral analysis is the examination of how a malicious code or program operates and behaves when executed. This analysis is important in order to understand how the malware is likely to behave when it infects a system and to identify any malicious activity that it may be carrying out.

  Behavioral analysis can be carried out in a number of ways, including by monitoring the system resources that the malware uses, tracking its network activity, and examining the files and registry keys that it modifies.

  Sandboxing

  There are a few key reasons why sandboxing is used in malware analysis. One reason is that it allows for a controlled environment in which to study the malware. This controlled environment can help researchers to understand how the malware works, what it does, and how it can be stopped. Additionally, sandboxing can help protect other systems on the network from being infected by the malware. By studying the malware in a sandbox, researchers can often develop countermeasures that can help protect other systems from being infected.

  Network simulations

  Network simulations are used in malware analysis to recreate the network activity of a malicious program. This can help analysts understand how the malware works and how it spreads. Network simulations can also be used to test defenses against malware.

  Sysmon

  Sysmon provides event logging and system activity monitoring. This can be used for behavioral analysis to identify malicious or unauthorized activity on a system. Sysmon logs keystrokes, process creations, network connections, and more. This can be used to help identify malware or other malicious activity.

• Memory Forensics

  Memory forensics is a key tool in malware analysis, because it allows you to capture and examine the state of a system's memory at any point in time. This can help you identify malicious code, track its execution, and understand how it interacts with the system.

  Volatility Framework

  The Volatility Framework is a set of tools for analyzing volatile memory (RAM) dumps. It can be used to detect and extract evidence from seized computers. In this course, you will learn how to analyse the following artefacts:

  • Windows registry
  • Processes and DLLs
  • Process memory
  • Kernel objects
  • Networking
  • GUI

  Detect code injection techniques

  Code injection is the process of placing executable code into another process' memory space. This can be done in a number of ways, but the most common is to use a programming language's built-in functions to write the code into memory. This code can then be executed by the target process, giving the attacker control over it. By detecting code injection in memory, forensic analysts can identify compromised systems and take steps to mitigate the risk.

  Using YARA to hunt for known malware across memory dumps

  YARA is a powerful tool that can be used to identify and hunt for known malware across memory dumps and other files. By using YARA rules, you can quickly and easily scan through large data sets to find specific malware signatures. This can be helpful in identifying and remediating an infection, as well as in conducting incident response investigations.

• Static Analysis

  Disassembly is the process of breaking down a compiled program into its assembly code. This process can be used to understand what malicious code does. Decompilation is the reverse engineering of executable files to source code.

  This course will teach you how to use static code analysis techniques to uncover the code logic of malware.

  Topics Covered:

  • Mastering Ghidra
  • Automated and manual decompilation
  • Annotation, bookmarks, references
  • Analysing different types of PEs
  • Decrypting data and binaries
  • Programming to assist static analysis
• Dynamic Analysis

  Dynamic Analysis is the process of executing a program in a controlled environment and observing the behavior of the program as it runs, often using a debugger. This technique is used to identify malware and uncover its functionality. Dynamic Analysis can be used to determine how a malware program interacts with the system and the files on the system. It can also be used to identify the malicious code in a program and reveal the activities of the malware.

  • Monitoring APIs
  • Defeating anti-debug techniques
  • Dynamically unpacking malware
  • Symbolic execution and emulation
  • Kernel-mode debugging
  • Programming to assist dynamic analysis
• Introduction to code obfuscation techniques and how to deal with them

  Code obfuscation is a technique used to make code more difficult to understand. This can be done in a variety of ways, such as inserting nonsense code, renaming variables, or using complex mathematical formulas. Code obfuscation is used primarily to protect intellectual property, but it is also used by malware authors to frustrate reverse engineers.

  Control Flow Flattening

  Control flow flattening for code obfuscation is a technique used to make the code more difficult to understand. The idea is to take a complex code sequence and flatten it out into a series of simple steps. This makes it more difficult for reverse engineers to understand how the code works and extract malware features.

  Opaque Predicates

  In computer science, an opaque predicate is a predicate (a function that takes one or more arguments and returns a boolean value) that is not analyzable by a humans. In other words, it is a predicate whose behavior cannot be determined by inspecting its code. This can be used for code obfuscation, as it makes it harder for malware analysts to determine which functions are important and which are not.

  Mixed Boolean Arithmetic

  Mixed Boolean Arithmetic obfuscation (MBA) is a technique used to hide code from prying eyes. It combines simple algebra with bitwise operations to make the code difficult to read and understand. MBA is often used to protect copyrightable code, trade secrets, or sensitive information.

  Strings and Code Encryption

  Malware encrypts its strings and code to make it more difficult for security analysts and antivirus software to detect and remove the malicious software. By encrypting the strings and code, the malware can remain undetected for longer and cause more damage.

  Instruction substitution

  Instruction substitution is a technique often used in code obfuscation. It replaces certain machine instructions with others, in order to make the code harder to understand and follow.

• How to write professional Malware Analysis Reports (MARs)

  Malware analysis reports (MARS) are documents created by analysts after they have performed a malware analysis. The report contains a detailed description of the malware, what it does, how it works, and any other information discovered about it.

  MARS are used to communicate the findings of a malware analysis to other members of the organization, as well as to law enforcement or other agencies if necessary. They can also be used as a reference for future investigations.

  Executive Summary

  An executive summary is a brief overview of a document. It is typically a few paragraphs long and is meant to give the reader a brief understanding of the document's contents. An executive summary is often used in reports, such as malware analysis reports, to provide a high-level overview of the report's findings.

  Sensitivity Classification

  A Sensitivity Classification is a key part of a malware analysis report because it helps to prioritize the data and analysis findings. The classification helps to identify the sensitivity of the data and whether or not it can be released to the public.

  Methodology

  When writing a malware analysis report, it is important to describe the methodology followed so that readers can understand how the analysis was conducted and what conclusions were drawn. This allows other researchers to build on the work that has been done, and it also helps to ensure that the analysis is reproducible. Additionally, describing the methodology can help to point out any potential flaws in the analysis.

  Limitations and constraints

  When writing a malware analysis report, it is important to list the limitations and constraints that were faced during the analysis. This will help others to understand any potential inaccuracies in the report. Additionally, it can help to identify any areas that may need further research. By acknowledging the limitations of the analysis, the author can provide a more accurate and complete report.

  Malware features and capabilities

  It is important to list all the malware features and capabilities discovered in order to give a comprehensive overview of the threat. This information can help security researchers and system administrators develop defenses against the threat and protect their networks and systems from attack. Additionally, by understanding the full range of capabilities of a piece of malware, investigators can more effectively track down its creators and distributors.

  Conclusions of Code Analysis and Observed Behavior

  When writing a malware analysis report, it is important to have a conclusion section. This section summarizes the key findings of the report, and can help to inform future defenses against the malware. Additionally, a conclusion section can help to ensure that the reader has a clear understanding of the report's findings.

• How to analyze ransomware, Remote Access Tools (RATs) and APT toolkits with user and kernel mode components