Defending Cyber Systems through Reverse Engineering of Criminal Malware

Description

This SpringerBrief discusses underlying principles of malware reverse engineering and introduces the major techniques and tools needed to effectively analyze malware that targets business organizations. It also covers the examination of real-world malware samples, which illustrates the knowledge and skills necessary to take control of cyberattacks. This SpringerBrief explores key tools and techniques to learn the main elements of malware analysis from the inside out. It also presents malware reverse engineering using several methodical phases, in order to gain a window into the mind set of hackers. Furthermore, this brief examines malicious program’s behavior and views its code-level patterns. Real world malware specimens are used to demonstrate the emerging behavioral patterns of battlefield malware as well. This SpringerBrief is unique, because it demonstrates the capabilities of emerging malware by conducting reverse-code engineering on real malware samples and conducting behavioral analysis in isolated lab system. Specifically, the author focuses on analyzing malicious Windows executables. This type of malware poses a large threat to modern enterprises. Attackers often deploy malicious documents and browser-based exploits to attack Windows enterprise environment. Readers learn how to take malware inside-out using static properties analysis, behavioral analysis and code-level analysis techniques. The primary audience for this SpringerBrief is undergraduate students studying cybersecurity and researchers working in this field. Cyber security professionals that desire to learn more about malware analysis tools and techniques will also want to purchase this SpringerBrief. Contents Chapter 1: Introduction to the Fascinating World of Malware Analysis What Is Malware Analysis? Malware Analysis Techniques Lab Setup for Detecting, Dissecting, and Analyzing Malware Lab Requirements Risks Associated with Analyzing Malware References Chapter 2: Static Analysis of Malware Static Analysis Initial Assessment of a Potential Malware Specimen: brbbot.exe Extracting String Strings Embedded in brbbot.exe Suggest a Few Potential Characteristics Deep-Dive into Static Properties Analysis Using PeStudio More Details of brbbot.exe from PeStudio Alternative Tools Portable Executable Headers Summarizing the Static Properties Analysis References Chapter 3: Behavioral Analysis Principles Behavioral Analysis Principles Behavioral Analysis Tools Process Hacker Conducting Behavioral Analysis Using brbbot.exe Regshot Wireshark for Capturing Network Traffic Dissecting and Analyzing Behavioral Analysis Findings Digging Deeper into the Findings Wireshark General Steps About Behavioral Analysis Closer Look at HTTP Connection Summary of Findings About brbbot.exe Through Behavioral Analysis Summary References Chapter 4: Principles of Code-Level Analysis Principles of Code-Level Analysis X64dbg Explained Deep-Dive into x64dbg Dissecting brbbot.exe API Monitor Interactive Behavioral Analysis brbbot.exe C2 Capabilities Summary References