[major=IA | course_id=IAM302 | syllabus_id=11196 | semester=5 | combo=core | title=Malware Analysis and Reverse Engineering]
Course ID: IAM302
Title EN: Malware Analysis and Reverse Engineering
Title VI: Phân tích mã độc và kỹ thuật dịch ngược
Credits: 3.0
Prerequisites: ITE303 or ITE302c, PRO192
Description: Information Assurance (IA) is a primary example of a field that can benefit greatly from malware analysis. IA aims to protect and defend information and information systems by ensuring their confidentiality, integrity, authentication, availability, and nonrepudiation. This is mostly based on designing measures that would ensure the protection of such systems and their associated data. This makes malware analysis an essential component of IA.
This course provides students with an effective immersion into the realm of Malware Analysis and Reverse Engineering. It follows a progressive approach that introduces relevant concepts and techniques while preparing students to become effective malware analysts that can use a standard methodology for detecting, analyzing, reverse engineering and eradicating malware.
Some of the key aspects of this course include reverse engineering malware from various sources and using various programming languages, including Web-based languages such as JavaScript as well as Document-based ones such as VBScript. This is accomplished by using a standard methodology that involves setting up an inexpensive laboratory, isolating it from production environments, and utilizing a selected set of forensic tools in order to dissect the malware, discover its characteristics, and neutralize its effects.
Scope: The scope of this course includes:
1. Introduction to Malware Analysis.
2. Malware Analysis Labs
3. Methodology to detect, analyze, reverse-engineer, and eradicate malware.
4. Malware Analysis Applications.
5. Forensics tools used for Malware Analysis.
Course Objectives: This course will equip students with the necessary background knowledge in order to become effective Malware Analysis & Reverse Engineering practitioners.
Student tasks: Students must attend at least 80% of contact sessions in order to be accepted to the final examination.
- Students are responsible to do all exercises, assignments and labs given by instructor in class or at home and submit on time
- Use laptop in class only for learning purpose
- Promptly access to the https://flm.fpt.edu.vn/ for up-to-date course information
Tools: 
Course type: traditional
Decision: 358/QĐ-ĐHFPT dated 04/03/2024
Approved date: 2024-04-03
CLO1: Develop a good understanding of Malware Analysis: today’s greatly increasing malware threats, malware activity mechanism and behavior, malware classification, building an environment to do static and dynamic malware analysis, methods and tools to detect, analyze, reverse-engineer, and eradicate malware.
[1] category=Lab; type=on-going; weight=40.0; duration=60-90'/each; question_type=LO1, LO2, LO4, LO5, LO6, LO7, LO8; grading_guide=technical aspect of studied topics; completion_criteria=; clos=4
[2] category=Participation in Discussions; type=on-going; weight=10.0; duration=; question_type=; grading_guide=; completion_criteria=; clos=>0
[3] category=Progress Test; type=on-going; weight=20.0; duration=30'/each; question_type=LO1, LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10, LO11, LO12, LO13, LO14, LO15, LO16, LO17, LO18, LO19, LO20, LO21, LO22, LO23, LO24, LO25, LO26, LO27, LO28, LO29, LO30, LO31, LO32, LO33, LO34, LO35, LO36, LO37, LO38, LO39, LO40, LO41, LO42, LO5, LO6, LO7, LO8; grading_guide=Test 1: cover Topics 1-4
- Test 2: cover Topics 5-7; completion_criteria=; clos=>0
[4] category=Final Exam; type=Final exam; weight=30.0; duration=60'; question_type=LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8; grading_guide=concepts, algorithms;
all studied topics; completion_criteria=; clos=4
[1] desc=Malware Analyst’s Cookbook and DVD: Tools and Techniques for fighting malicious code; author=Michael Hale Ligh, Steven Adair, Blake Hartstein, and Matthew Richard; publisher=Wiley Publishing; edition=; isbn=978-0470613030; main=True; online=True; note=Hardcopy version is in the FPTU library as well.
[2] desc=Introduction to Malware Analysis (whitepaper); author=Lenny Zeltser; publisher=SANS Institute; edition=; isbn=; main=; online=; note=
[3] desc=Malware Forensics: Investigating and Analyzing Malicious Code (online: http://library.fpt.edu.vn/book24x7.html).; author=James Aquilina, Cameron Malin, Eoghan Casey; publisher=Syngress Publing; edition=; isbn=; main=; online=True; note=
[4] desc=https://samsclass.info/126/126_S17.shtml; author=; publisher=; edition=; isbn=; main=; online=True; note=
[5] desc=Learning Python; author=Mark Lutz; publisher=O’Reilly; edition=; isbn=; main=; online=; note=
[6] desc=Lecture slides, Lab manual (ppt); author=; publisher=; edition=; isbn=; main=; online=; note=
Session 1: Topic 1. Introduction
1.1 Course Expectations
Topic: Offline; Teaching type: LO1; LO: IT
ITU: Course syllabus, Textbook, Lab Manual, Slides
Materials: mat1
Download: Read Materials, Discussion, Review Lecture

Session 2: Topic 1. Introduction (cont.)
1.2 Course Introduction
Topic: Offline; Teaching type: LO1; LO: IT
ITU: Course syllabus, Textbook, Lab Manual, Slides
Materials: mat2
Download: Read Materials, Discussion, Review Lecture

Session 3: Topic 2. Fundamentals of Malware Analysis 2.1 Reverse Engineering Malware (REM) Methodology
2.2 Brief Overview of Malware analysis lab setup and configuration
Topic: Offline; Teaching type: LO1, LO2, LO3; LO: T
ITU: Ref [2] , Slides
Download: Review Lecture

Session 4: Topic 2. Fundamentals of Malware Analysis (cont.)
2.3 Introduction to key MA tools and techniques
2.4 Behavioral Analysis vs. Code Analysis
Topic: Offline; Teaching type: LO1, LO2, LO3; LO: T
ITU: Ref [2] , Slides
Download: Review Lecture
CLO2: Identify the different types of Malware Analysis methods: static (ASCII, binary, logical signature detection), dynamic (network traffic analysis, memory forensics, dynamic reverse engineering) and hybrid.
Session 1: Lab 1: Setting Up Environment
Topic: Offline; Teaching type: LO1, LO4; LO: TU
ITU: Textbook, Introduction
Lab Manual
Download: Review Lab 1

Session 2: Lab 1: Setting Up Environment (cont.)
Topic: Offline; Teaching type: LO1, LO4; LO: TU
ITU: Textbook, Introduction
Lab Manual
Download: Review Lab 1

Session 3: Topic 3. Malware Classification
3.1 Understanding Malware Threats
3.2 Malware indicators
Topic: Offline; Teaching type: LO2, LO3; LO: T
ITU: Slides
Chapter 3
Download: Review Lecture

Session 4: Topic 3. Malware Classification (cont.)
3.3 Malware Classification
Topic: Offline; Teaching type: LO2, LO3; LO: T
ITU: Slides
Chapter 3
Download: Review Lecture
CLO3: Gain a broad exposure to real world applications of Malware Analysis: take control of the incident, incident response, analyze the threat, examine interactions with the environment, mitigate the risks of malware attempting to escape from the lab,
Session 1: Lab 2: Examining ClamAV Signature
Topic: Offline; Teaching type: LO2, LO5; LO: U
ITU: Recipe 3.1
Lab Manual
Download: Review Lab 2

Session 2: Lab 2: Examining ClamAV Signature (cont.)
Topic: Offline; Teaching type: LO2, LO5; LO: U
ITU: Recipe 3.1
Lab Manual
Download: Review Lab 2

Session 3: Lab 3: Creating Custom ClamAV Databases
Topic: Offline; Teaching type: LO2, LO5; LO: U
ITU: Recipe 3.2
Lab Manual
Download: Review Lab 3

Session 4: Lab 3: Creating Custom ClamAV Databases (cont.)
Topic: Offline; Teaching type: LO2, LO5; LO: U
ITU: Recipe 3.2
Lab Manual
Download: Review Lab 3
CLO4: Set up a relatively inexpensive lab for Malware Analysis activities.
Session 1: Lab 4: Detect Malware Capabilities with YARA (a difference with ClamAV)
Topic: Offline; Teaching type: LO2, LO5; LO: TU
ITU: Recipe 3.5
Lab Manual
Download: Review Lab 4

Session 2: Lab 4: Detect Malware Capabilities with YARA (a difference with ClamAV) (cont.)
Topic: Offline; Teaching type: LO2, LO5; LO: TU
ITU: Recipe 3.5
Lab Manual
Download: Review Lab 4

Session 3: Topic 4. Malware Labs 4.1. Introduction to MA Sandboxes
4.1.1 Ubuntu
Topic: Offline; Teaching type: LO4, LO6; LO: T
ITU: Overview
Chapter 4
Slides
Download: Review Lecture

Session 4: Topic 4. Malware Labs (cont.)
4.1. Introduction to MA Sandboxes (cont.)
4.1.2 Zeltser’s REMnux
4.1.3 SANS SIFT
Topic: Offline; Teaching type: LO4, LO6; LO: T
ITU: Overview
Chapter 4
Slides
Download: Review Lecture
CLO5: Utilize a standard methodology for detecting, analyzing, reverse engineering, and eradicating malware.
Session 1: Lab 5: Sandbox Setup and Configuration
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Slides, Lab Manual
Download: Review Lab 5

Session 2: Lab 5: Sandbox Setup and Configuration (cont.)
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Slides, Lab Manual
Download: Review Lab 5

Session 3: Lab 6: Public AV Scanners (VirusTotal, Jotti)
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Recipes 4.1, 4.2
Lab Manual
Download: Review Lab 6

Session 4: Lab 6: Public AV Scanners (VirusTotal, Jotti) (cont.)
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Recipes 4.1, 4.2
Lab Manual
Download: Review Lab 6
CLO6: Use a Malware Analysis-based approach in order to resolve real world problems.
Session 1: Lab 7: MA with CWSandbox, Anubis
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Recipes 4.6, 4.7
Lab Manual
Download: Review Lab 7

Session 2: Lab 7: MA with CWSandbox, Anubis (cont.)
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Recipes 4.6, 4.7
Lab Manual
Download: Review Lab 7

Session 3: Review Topics 1-4 (Guiding Problems)
Topic: Offline; Teaching type: LO4, LO6; LO: 
ITU: Review Topics 1-4

Session 4: Progress Test 1 (30’)
Topic: Offline; Teaching type: ; LO: 
ITU:
CLO7: Recognize common malware characteristics: propagation, infection, self-defense, capabilities, …
Session 1: Topic 5. Malware Lab Integrity
5.1 Routing TCP/IP Connections
5.2 Capturing and Analyzing Network Traffic
5.3 Internet simulation using INetSim
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Recipes 7.1, 7.2, 7.3
Lab Manual
Download: Review Lecture

Session 2: Lab 8: Configuring a Malware Lab
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Recipes 7.1, 7.2, 7.3
Lab Manual
Download: Review Lab 8

Session 3: Lab 9: Recipe Manipulating HTTP/HTTPS with Burp Suite
Reading: Recipe 7-5 - Using Joe Stewart’s Truman
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Recipe 7.4
Lab Manual
Download: Review Lab 9

Session 4: Lab 9: Recipe Manipulating HTTP/HTTPS with Burp Suite
Reading: Recipe 7-5 - Using Joe Stewart’s Truman (cont.)
Topic: Offline; Teaching type: LO4, LO6; LO: TU
ITU: Recipe 7.4
Lab Manual
Download: Review Lab 9
CLO8: Bypass some of the advanced malware techniques, such as packing, obfuscation and anti-analysis of armored malware breeds.
Session 1: Lab 10: Using Deep Freeze to Preserve Physical Systems
Topic: Offline; Teaching type: LO4, LO6; LO: U
ITU: Recipe 7.6
Lab Manual
Download: Review Lab 10

Session 2: Lab 10: Using Deep Freeze to Preserve Physical Systems (cont.)
Topic: Offline; Teaching type: LO4, LO6; LO: U
ITU: Recipe 7.6
Lab Manual
Download: Review Lab 10

Session 3: Lab 11: Using FOG for Cloning and Imaging Disks
Topic: Offline; Teaching type: LO4, LO6; LO: U
ITU: Recipe 7.7
Lab Manual
Download: Review Lab 11

Session 4: Lab 11: Using FOG for Cloning and Imaging Disks (cont.)
Topic: Offline; Teaching type: LO4, LO6; LO: U
ITU: Recipe 7.7
Lab Manual
Download: Review Lab 11
Session 1: Topic 6. Malware Analysis Tools
6.1 Introduction to Python
6.2 Introduction to x86 Intel assembly language
Topic: Offline; Teaching type: LO4, LO6; LO: T
ITU: Python, x86 references, Recipe 4-4
Slides
Download: Review Lecture

Session 2: Topic 6. Malware Analysis Tools (cont.)
6.3 Database-Enabled Multi-AV Uploader in Python
Topic: Offline; Teaching type: LO4, LO6; LO: T
ITU: Python, x86 references, Recipe 4-4
Slides
Download: Review Lecture

Session 3: Lab 12: Dynamic Analysis Tools (Process Monitor, Regshot, HandleDiff)
Topic: Offline; Teaching type: LO5, LO7; LO: TU
ITU: Recipes 9.1, 9.2, 9.6
Lab Manual
Download: Review Lab 12

Session 4: Lab 12: Dynamic Analysis Tools (Process Monitor, Regshot, HandleDiff) (cont.)
Topic: Offline; Teaching type: LO5, LO7; LO: TU
ITU: Recipes 9.1, 9.2, 9.6
Lab Manual
Download: Review Lab 12
Session 1: Lab 13: Analysis Automation Tools: VirtualBox, VMWare, TShark, …
Topic: Offline; Teaching type: LO5, LO7; LO: TU
ITU: Recipes 8.1-8.4
Lab Manual
Download: Review Lab 13

Session 2: Lab 13: Analysis Automation Tools: VirtualBox, VMWare, TShark, … (cont.)
Topic: Offline; Teaching type: LO5, LO7; LO: TU
ITU: Recipes 8.1-8.4
Lab Manual
Download: Review Lab 13

Session 3: Topic 7. Malware Forensics
Topic: Offline; Teaching type: LO8; LO: TU
ITU: Recipes 10.1 - 10.3
Lab Manual
Download: Review Lab 14

Session 4: Lab 14: Using TSK for Network and Host
Topic: Offline; Teaching type: LO8; LO: TU
ITU: Recipes 10.1 - 10.3
Lab Manual
Download: Review Lab 14
Session 1: Lab 15: Identifying Packers using PEiD
Topic: Offline; Teaching type: LO8; LO: U
ITU: Recipe 3.4
Lab Manual
Download: Review Lab 15

Session 2: Lab 15: Identifying Packers using PEiD (cont.)
Topic: Offline; Teaching type: LO8; LO: U
ITU: Recipe 3.4
Lab Manual
Download: Review Lab 15

Session 3: Lab16: Registry Forensics with RegRipper Plug-ins
Topic: Offline; Teaching type: LO8; LO: U
ITU: Recipe 10.8
Lab Manual
Download: Review Lab 16

Session 4: Lab16: Registry Forensics with RegRipper Plug-ins (cont.)
Topic: Offline; Teaching type: LO8; LO: U
ITU: Recipe 10.8
Lab Manual
Download: Review Lab 16
Session 1: 7.A Case Studies (discussion):
7.A.1 Bypassing Poison Ivy’s Locked Files
Topic: Offline; Teaching type: LO8; LO: U
ITU: Recipes 10.4, 10.5, 10.9
Download: https://flm.fpt.edu.vn/gui/role/student/Review Chapter 10.4, 10.5, 10.9

Session 2: 7.A Case Studies (discussion): (cont.)
7.A.2 Bypassing Conficker’s File System ACL Restrictions
7.A.3 Detecting Rogue PKI Certificates
Topic: Offline; Teaching type: LO8; LO: U
ITU: Recipes 10.4, 10.5, 10.9
Download: https://flm.fpt.edu.vn/gui/role/student/Review Chapter 10.4, 10.5, 10.9

Session 3: Review Topics 5-7 (Guiding Problems)
Topic: Offline; Teaching type: ; LO: 
ITU: Review Topics 5-7

Session 4: Progress Test 2 (30’)
Topic: Offline; Teaching type: ; LO: 
ITU:
Session 1: Topic 8. Malware Debugging
8.1 Overview of Malware Debuggers (OllyDbg,…)
Topic: Offline; Teaching type: LO5, LO7; LO: T
ITU: Recipes 11.1-11.9
Chapter 11
Download: https://flm.fpt.edu.vn/gui/role/student/Review Chapter 11.1-11.9

Session 2: Topic 8. Malware Debugging (cont.)
8.1 Overview of Malware Debuggers (OllyDbg,…) (cont.)
Topic: Offline; Teaching type: LO5, LO7; LO: T
ITU: Recipes 11.1-11.9
Chapter 11
Download: https://flm.fpt.edu.vn/gui/role/student/Review Chapter 11.1-11.9

Session 3: Lab 17: Implementing a JIT (just-in-time) Debugger for Shellcode Analysis
Topic: Offline; Teaching type: LO5, LO7; LO: U
ITU: Recipe 11.2
Lab Manual
Download: Review Lab 17

Session 4: Lab 17: Implementing a JIT (just-in-time) Debugger for Shellcode Analysis (cont.)
Topic: Offline; Teaching type: LO5, LO7; LO: U
ITU: Recipe 11.2
Lab Manual
Download: Review Lab 17
Session 1: Topic 9. Memory Forensics with Volatility 9.1 Memory Acquisition
Topic: Offline; Teaching type: LO5, LO7; LO: T
ITU: Slides
Chapter 15.1 – 15.4
Download: Review Lecture

Session 2: Topic 9. Memory Forensics with Volatility (cont.)
9.2 Accessing VM Memory Files
9.3 Preparing a Volatility Install
Topic: Offline; Teaching type: LO5, LO7; LO: T
ITU: Slides
Chapter 15.1 – 15.4
Download: Review Lecture

Session 3: Lab 18: Memory Dump Tool (MoonSols Windows Memory Toolkit)
Topic: Offline; Teaching type: LO5, LO7; LO: U
ITU: Recipe 15.1
Lab Manual
Download: Review Lab 18

Session 4: Lab 18: Memory Dump Tool (MoonSols Windows Memory Toolkit) (cont.)
Topic: Offline; Teaching type: LO5, LO7; LO: U
ITU: Recipe 15.1
Lab Manual
Download: Review Lab 18
Session 1: Lab 19: Memory Analysis Tool (Volatility Framework)
Topic: Offline; Teaching type: LO5, LO7; LO: U
ITU: Recipe 15.4
Lab Manual
Download: Review Lab 19

Session 2: Lab 19: Memory Analysis Tool (Volatility Framework) (cont.)
Topic: Offline; Teaching type: LO5, LO7; LO: U
ITU: Recipe 15.4
Lab Manual
Download: Review Lab 19

Session 3: Course Review
Topic: Offline; Teaching type: ; LO: 
ITU: Topics 1 - 9

Session 4: Course Review (cont.)
Topic: Offline; Teaching type: ; LO: 
ITU: Topics 1 - 9