Malware Analysis and Reverse Engineering (IAM302)
Vietnamese title: Phân tích mã độc và kỹ thuật dịch ngược
Credits: 3
Prerequisites: ITE303 or ITE302c, PRO192

Description:
Information Assurance (IA) is a primary example of a field that can benefit greatly from malware analysis. IA aims to protect and defend information and information systems by ensuring their confidentiality, integrity, authentication, availability, and nonrepudiation. This is mostly based on designing measures that would ensure the protection of such systems and their associated data. This makes malware analysis an essential component of IA.
This course provides students with an effective immersion into the realm of Malware Analysis and Reverse Engineering. It follows a progressive approach that introduces relevant concepts and techniques while preparing students to become effective malware analysts that can use a standard methodology for detecting, analyzing, reverse engineering and eradicating malware.
Some of the key aspects of this course include reverse engineering malware from various sources and using various programming languages, including Web-based languages such as JavaScript as well as Document-based ones such as VBScript. This is accomplished by using a standard methodology that involves setting up an inexpensive laboratory, isolating it from production environments, and utilizing a selected set of forensic tools in order to dissect the malware, discover its characteristics, and neutralize its effects.
Scope: The scope of this course includes:
1. Introduction to Malware Analysis.
2. Malware Analysis Labs
3. Methodology to detect, analyze, reverse-engineer, and eradicate malware.
4. Malware Analysis Applications.
5. Forensics tools used for Malware Analysis.
Course Objectives: This course will equip students with the necessary background knowledge in order to become effective Malware Analysis & Reverse Engineering practitioners.

Learning outcomes:
Develop a good understanding of Malware Analysis: today’s greatly increasing malware threats, malware activity mechanism and behavior, malware classification, building an environment to do static and dynamic malware analysis, methods and tools to detect, analyze, reverse-engineer, and eradicate malware.
Identify the different types of Malware Analysis methods: static (ASCII, binary, logical signature detection), dynamic (network traffic analysis, memory forensics, dynamic reverse engineering) and hybrid.
Gain a broad exposure to real world applications of Malware Analysis: take control of the incident, incident response, analyze the threat, examine interactions with the environment, mitigate the risks of malware attempting to escape from the lab,
Set up a relatively inexpensive lab for Malware Analysis activities.
Utilize a standard methodology for detecting, analyzing, reverse engineering, and eradicating malware.
Use a Malware Analysis-based approach in order to resolve real world problems.
Recognize common malware characteristics: propagation, infection, self-defense, capabilities, …
Bypass some of the advanced malware techniques, such as packing, obfuscation and anti-analysis of armored malware breeds.

Student tasks:
Students must attend at least 80% of contact sessions in order to be accepted to the final examination.
- Students are responsible to do all exercises, assignments and labs given by instructor in class or at home and submit on time
- Use laptop in class only for learning purpose
- Promptly access to the https://flm.fpt.edu.vn/ for up-to-date course information

Tools:

Materials:
description: Malware Analyst’s Cookbook and DVD: Tools and Techniques for fighting malicious code
author: Michael Hale Ligh, Steven Adair, Blake Hartstein, and Matthew Richard
publisher: Wiley Publishing
published_date: 2011
isbn: 978-0470613030
note: Hardcopy version is in the FPTU library as well.
description: Introduction to Malware Analysis (whitepaper)
author: Lenny Zeltser
publisher: SANS Institute
published_date: 2010
description: Malware Forensics: Investigating and Analyzing Malicious Code (online: http://library.fpt.edu.vn/book24x7.html).
author: James Aquilina, Cameron Malin, Eoghan Casey
publisher: Syngress Publing
published_date: 2008
description: https://samsclass.info/126/126_S17.shtml
description: Learning Python
author: Mark Lutz
publisher: O’Reilly
published_date: 2013
description: Lecture slides, Lab manual (ppt)

Assessments:
category: Lab
type: on-going
weight: 40.0
duration: 60-90'/each
question_type: LO1, LO2, LO4, LO5, LO6, LO7, LO8
no_question: practical exercises
grading_guide: technical aspect of studied topics
note: in class - Guided by instructor
- 19 Lab sessions are arranged relevant to the chapter theory
- Student must finish labs and submit the results to the instructor in class.
- An average point of all labs could be evaluated and published to students at the end of the semesters
category: Participation in Discussions
type: on-going
weight: 10.0
category: Progress Test
type: on-going
weight: 20.0
duration: 30'/each
question_type: LO1, LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10, LO11, LO12, LO13, LO14, LO15, LO16, LO17, LO18, LO19, LO20, LO21, LO22, LO23, LO24, LO25, LO26, LO27, LO28, LO29, LO30, LO31, LO32, LO33, LO34, LO35, LO36, LO37, LO38, LO39, LO40, LO41, LO42, LO5, LO6, LO7, LO8
no_question: Multiple choices
Marked by Computer or a suitable format
knowledge_and_skill: 20/each
grading_guide: Test 1: cover Topics 1-4
- Test 2: cover Topics 5-7
note: in class, by instructor
category: Final Exam
type: Final exam
weight: 30.0
duration: 60'
question_type: LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8
no_question: Multiple choicesMarked by Computer
knowledge_and_skill: 50
grading_guide: concepts, algorithms;
all studied topics
note: by exam board,
using computer

Schedule:
session: Topic 1. Introduction
1.1 Course Expectations
learning_outcomes: IT
materials: mat1
session: Topic 1. Introduction (cont.)
1.2 Course Introduction
learning_outcomes: IT
materials: mat2
session: Topic 2. Fundamentals of Malware Analysis 2.1 Reverse Engineering Malware (REM) Methodology
2.2 Brief Overview of Malware analysis lab setup and configuration
learning_outcomes: T
session: Topic 2. Fundamentals of Malware Analysis (cont.)
2.3 Introduction to key MA tools and techniques
2.4 Behavioral Analysis vs. Code Analysis
learning_outcomes: T
session: Lab 1: Setting Up Environment
learning_outcomes: TU
session: Lab 1: Setting Up Environment (cont.)
learning_outcomes: TU
session: Topic 3. Malware Classification
3.1 Understanding Malware Threats
3.2 Malware indicators
learning_outcomes: T
session: Topic 3. Malware Classification (cont.)
3.3 Malware Classification
learning_outcomes: T
session: Lab 2: Examining ClamAV Signature
learning_outcomes: U
session: Lab 2: Examining ClamAV Signature (cont.)
learning_outcomes: U
session: Lab 3: Creating Custom ClamAV Databases
learning_outcomes: U
session: Lab 3: Creating Custom ClamAV Databases (cont.)
learning_outcomes: U
session: Lab 4: Detect Malware Capabilities with YARA (a difference with ClamAV)
learning_outcomes: TU
session: Lab 4: Detect Malware Capabilities with YARA (a difference with ClamAV) (cont.)
learning_outcomes: TU
session: Topic 4. Malware Labs 4.1. Introduction to MA Sandboxes
4.1.1 Ubuntu
learning_outcomes: T
session: Topic 4. Malware Labs (cont.)
4.1. Introduction to MA Sandboxes (cont.)
4.1.2 Zeltser’s REMnux
4.1.3 SANS SIFT
learning_outcomes: T
session: Lab 5: Sandbox Setup and Configuration
learning_outcomes: TU
session: Lab 5: Sandbox Setup and Configuration (cont.)
learning_outcomes: TU
session: Lab 6: Public AV Scanners (VirusTotal, Jotti)
learning_outcomes: TU
session: Lab 6: Public AV Scanners (VirusTotal, Jotti) (cont.)
learning_outcomes: TU
session: Lab 7: MA with CWSandbox, Anubis
learning_outcomes: TU
session: Lab 7: MA with CWSandbox, Anubis (cont.)
learning_outcomes: TU
session: Review Topics 1-4 (Guiding Problems)
session: Progress Test 1 (30’)
session: Topic 5. Malware Lab Integrity
5.1 Routing TCP/IP Connections
5.2 Capturing and Analyzing Network Traffic
5.3 Internet simulation using INetSim
learning_outcomes: TU
session: Lab 8: Configuring a Malware Lab
learning_outcomes: TU
session: Lab 9: Recipe Manipulating HTTP/HTTPS with Burp Suite
Reading: Recipe 7-5 - Using Joe Stewart’s Truman
learning_outcomes: TU
session: Lab 9: Recipe Manipulating HTTP/HTTPS with Burp Suite
Reading: Recipe 7-5 - Using Joe Stewart’s Truman (cont.)
learning_outcomes: TU
session: Lab 10: Using Deep Freeze to Preserve Physical Systems
learning_outcomes: U
session: Lab 10: Using Deep Freeze to Preserve Physical Systems (cont.)
learning_outcomes: U
session: Lab 11: Using FOG for Cloning and Imaging Disks
learning_outcomes: U
session: Lab 11: Using FOG for Cloning and Imaging Disks (cont.)
learning_outcomes: U
session: Topic 6. Malware Analysis Tools
6.1 Introduction to Python
6.2 Introduction to x86 Intel assembly language
learning_outcomes: T
session: Topic 6. Malware Analysis Tools (cont.)
6.3 Database-Enabled Multi-AV Uploader in Python
learning_outcomes: T
session: Lab 12: Dynamic Analysis Tools (Process Monitor, Regshot, HandleDiff)
learning_outcomes: TU
session: Lab 12: Dynamic Analysis Tools (Process Monitor, Regshot, HandleDiff) (cont.)
learning_outcomes: TU
session: Lab 13: Analysis Automation Tools: VirtualBox, VMWare, TShark, …
learning_outcomes: TU
session: Lab 13: Analysis Automation Tools: VirtualBox, VMWare, TShark, … (cont.)
learning_outcomes: TU
session: Topic 7. Malware Forensics
learning_outcomes: TU
session: Lab 14: Using TSK for Network and Host
learning_outcomes: TU
session: Lab 15: Identifying Packers using PEiD
learning_outcomes: U
session: Lab 15: Identifying Packers using PEiD (cont.)
learning_outcomes: U
session: Lab16: Registry Forensics with RegRipper Plug-ins
learning_outcomes: U
session: Lab16: Registry Forensics with RegRipper Plug-ins (cont.)
learning_outcomes: U
session: 7.A Case Studies (discussion):
7.A.1 Bypassing Poison Ivy’s Locked Files
learning_outcomes: U
session: 7.A Case Studies (discussion): (cont.)
7.A.2 Bypassing Conficker’s File System ACL Restrictions
7.A.3 Detecting Rogue PKI Certificates
learning_outcomes: U
session: Review Topics 5-7 (Guiding Problems)
session: Progress Test 2 (30’)
session: Topic 8. Malware Debugging
8.1 Overview of Malware Debuggers (OllyDbg,…)
learning_outcomes: T
session: Topic 8. Malware Debugging (cont.)
8.1 Overview of Malware Debuggers (OllyDbg,…) (cont.)
learning_outcomes: T
session: Lab 17: Implementing a JIT (just-in-time) Debugger for Shellcode Analysis
learning_outcomes: U
session: Lab 17: Implementing a JIT (just-in-time) Debugger for Shellcode Analysis (cont.)
learning_outcomes: U
session: Topic 9. Memory Forensics with Volatility 9.1 Memory Acquisition
learning_outcomes: T
session: Topic 9. Memory Forensics with Volatility (cont.)
9.2 Accessing VM Memory Files
9.3 Preparing a Volatility Install
learning_outcomes: T
session: Lab 18: Memory Dump Tool (MoonSols Windows Memory Toolkit)
learning_outcomes: U
session: Lab 18: Memory Dump Tool (MoonSols Windows Memory Toolkit) (cont.)
learning_outcomes: U
session: Lab 19: Memory Analysis Tool (Volatility Framework)
learning_outcomes: U
session: Lab 19: Memory Analysis Tool (Volatility Framework) (cont.)
learning_outcomes: U
session: Course Review
session: Course Review (cont.)