What has become accepted as malware reverse engineering training involves full-spectrum analysis of malicious code both dynamically (run-time) and statically (disassembly). What this means for _run-time analysis is that you put the malware on a virtual machine and run a packet sniffer (like Wireshark), a registry monitor (like RegShot), a file monitor (like CaptureBat) and then a process monitor (like Process Explorer and Process Monitor). Debugging involves looking at the malware in a disassembler (like IDA Pro). The goal is to understand the code and its behavior in order to find the functionality and or obfuscation methods within the malicious binary.
Learning Objectives
Skills class to enhance overall cybersecurity skillset
Framework Connections
Competency Areas
Feedback
If you would like to provide feedback for this course, please e-mail the NICCS SO at NICCS@hq.dhs.gov.