Malware Analysis

  1. Basic Dynamic Analysis
    1. Observing Malware in Action
      1. Goals and Safety Precautions
        1. Controlled Environment Setup
        2. Sandboxing
          1. Automated Sandbox Systems
            1. Cuckoo Sandbox
              1. Joe Sandbox
                1. Any.run
                  1. Features and Limitations
                  2. Manual Analysis in a VM
                    1. Setting Up the Environment
                      1. Baseline Creation
                        1. Execution Monitoring
                      2. Monitoring System Changes
                        1. Process Monitoring
                          1. Process Creation and Termination
                            1. Parent-Child Process Relationships
                              1. Process Injection Detection
                                1. Command Line Arguments
                                  1. Process Tree Analysis
                                  2. File System Monitoring
                                    1. File Creation, Deletion, and Modification
                                      1. Hidden and Temporary Files
                                        1. Directory Changes
                                          1. File Attribute Modifications
                                          2. Registry Monitoring (Windows)
                                            1. Key Creation, Deletion, and Modification
                                              1. Autostart Persistence Locations
                                                1. Run Keys
                                                  1. Services
                                                    1. Scheduled Tasks
                                                    2. Registry Value Changes
                                                      1. Registry Hive Modifications
                                                    3. Monitoring Network Behavior
                                                      1. Simulating Network Services
                                                        1. FakeNet-NG
                                                          1. INetSim
                                                            1. Custom Service Emulation
                                                              1. DNS Simulation
                                                              2. Capturing and Analyzing Network Traffic
                                                                1. Packet Sniffing
                                                                  1. Wireshark
                                                                    1. tcpdump
                                                                    2. Identifying Protocols
                                                                      1. HTTP/HTTPS
                                                                        1. DNS
                                                                          1. SMTP
                                                                            1. FTP
                                                                            2. DNS Queries
                                                                              1. Domain Generation Algorithms (DGA)
                                                                                1. DNS Tunneling
                                                                                2. HTTP/HTTPS Traffic
                                                                                  1. User-Agent Analysis
                                                                                    1. POST/GET Requests
                                                                                      1. SSL/TLS Analysis
                                                                                      2. Command and Control (C2) Beaconing
                                                                                        1. Beacon Intervals
                                                                                          1. Communication Patterns
                                                                                          2. Data Exfiltration Detection
                                                                                            1. Large Data Transfers
                                                                                              1. Unusual Protocols

                                                                                        Previous

                                                                                        3. Basic Static Analysis

                                                                                        Go to top

                                                                                        Next

                                                                                        5. Advanced Static Analysis (Code-Level)