Introduction to Malware

Malware making is the part of cybersecurity course. Malware (Malicious Software) is any program designed to harm, exploit, or infiltrate a system without the user's consent. It includes viruses, worms, trojans, ransomware, spyware, and more.

---

Types of Malware

1. Viruses

• Attaches itself to clean files and spreads when executed.
• Example: ILOVEYOU, Melissa.

2. Worms

• Self-replicating malware that spreads over networks.
• Example: WannaCry, Conficker.

3. Trojans

• Disguised as legitimate software but performs malicious actions.
• Example: Zeus, Emotet.

4. Ransomware

• Encrypts files and demands payment for decryption.
• Example: REvil, LockBit.

5. Spyware

• Secretly monitors user activity (keyloggers, screen capture).
• Example: DarkComet, FinFisher.

6. Rootkits

• Gains privileged access and hides malicious processes.
• Example: Stuxnet, TDL4.

7. Adware

• Displays unwanted ads and collects user data.
• Example: Fireball, Superfish.

8. Botnets

• Infected devices controlled remotely (DDoS, spam).
• Example: Mirai, Zeus.

---

Malware Analysis Techniques

1. Static Analysis

• Examines malware without executing it.
• Tools: PEiD, Exeinfo PE, Strings, IDA Pro, Ghidra.
• Techniques:
  • File hashing (MD5, SHA-1, SHA-256)
  • Header analysis (PE, ELF, Mach-O)
  • Strings extraction
  • Disassembly & decompilation

2. Dynamic Analysis

• Executes malware in a controlled environment.
• Tools: Cuckoo Sandbox, Process Monitor, Wireshark, FakeNet.
• Techniques:
  • API call monitoring
  • Registry & file system changes
  • Network traffic analysis
  • Behavioral analysis

3. Hybrid Analysis

• Combines static and dynamic techniques.
• Tools: Hybrid Analysis, VirusTotal, Joe Sandbox.

---

Malware Analysis Lab Setup

1. Isolated Environment

• Use virtual machines (VMWare, VirtualBox).
• Disable shared folders & clipboard.
• Use Windows 10/11 (for malware targeting Windows).

2. Analysis Tools

Static Analysis:

• PE Explorer (PE header analysis)
• Ghidra (reverse engineering)
• Detect It Easy (DIE) (packer detection)

Dynamic Analysis:

• Process Hacker (monitor processes)
• ProcMon (registry/file monitoring)
• Wireshark (network traffic)
• FakeNet-NG (simulate network)

Sandboxing:

• Cuckoo Sandbox (automated analysis)
• Any.Run (interactive sandbox)

3. Malware Samples

Legitimate Sources:

• MalwareBazaar
• VirusShare
• TheZoo (GitHub repo)

---

Step-by-Step Malware Analysis

1. Initial Assessment

• Check file type (file, Exeinfo PE)
• Calculate hashes (md5sum, sha256sum)
• Scan with VirusTotal

2. Static Analysis

• Extract strings (strings, FLOSS)
• Detect packers/obfuscation (PEiD, Detect It Easy)
• Disassemble with Ghidra/IDA Pro

3. Dynamic Analysis

• Run in Cuckoo Sandbox
• Monitor processes (Process Hacker)
• Capture network traffic (Wireshark)
• Check persistence mechanisms (Registry, Startup)

4. Reverse Engineering

• Use Ghidra/IDA Pro for decompilation
• Analyze API calls (Import Address Table)
• Debug with x64dbg/OllyDbg

5. Reporting

• Document findings (IOCs, behavior, C2 servers)
• Extract YARA rules for detection

---

Advanced Malware Analysis

1. Analyzing Packed Malware

Unpacking Tools:

• UPX (for UPX-packed malware)
• x64dbg (manual unpacking)

2. Analyzing Shellcode

Tools:

• scdbg (shellcode debugger)
• Libemu (shellcode emulator)

3. Analyzing Document-Based Malware (PDF, Office)

Tools:

• oleid (Office file analysis)
• PDFiD (PDF analysis)

4. Analyzing Ransomware

• Check encryption routines
• Look for ransom note patterns
• Analyze C2 communication

---

Malware Detection & Prevention

1. Signature-Based Detection

• Uses known malware hashes (YARA rules, ClamAV)

2. Behavioral Detection

• Monitors unusual activities (Cylance, CrowdStrike)

3. Heuristic Analysis

• Detects unknown malware based on behavior

4. Endpoint Protection

EDR (Endpoint Detection & Response) tools:

• CrowdStrike Falcon
• Microsoft Defender ATP

5. Network-Based Protection

• Firewalls, IDS/IPS, SIEM (Splunk, ELK)

---

Conclusion

• Malware analysis requires both static and dynamic techniques.
• Always analyze in a safe, isolated environment.
• Keep learning reverse engineering and behavioral analysis.
• Stay updated with new malware trends (fileless malware, AI-based attacks).

🔹 Next Steps

• Module 6: Sniffing & Session Hijacking
• Practice with CTF challenges (MalwareTech, Flare-On)
• Join malware research communities (Malwarebytes, BleepingComputer)
• Contribute to open-source malware analysis tools

---