Tutoriales de análisis de malware: un enfoque de ingeniería inversa

[r32]

Hoja de ruta: Debe primero seguir los tutoriales de 1 a 4 para establecer la configuración del laboratorio. A continuación, cada tutorial se aborda un tema independiente y se puede completar por separado (cada uno tendrá sus propias instrucciones de configuración de laboratorio).


Malware Analysis Tutorial 1- A Reverse Engineering Approach (Lesson 1: VM Based Analysis Platform)
Link: http://fumalwareanalysis.blogspot.com/2011/08/malware-analysis-tutorial-reverse.html

Malware Analysis Tutorial 2- Introduction to Ring3 Debugging
Link: http://fumalwareanalysis.blogspot.com/2011/08/malware-analysis-tutorial-reverse_31.html

Malware Analysis Tutorial 3- Int 2D Anti-Debugging .
Link: http://fumalwareanalysis.blogspot.com/2011/09/malware-analysis-3-int2d-anti-debugging.html

Malware Analysis Tutorial 4- Int 2D Anti-Debugging (Part II)
Link: http://fumalwareanalysis.blogspot.com/2011/10/malware-analysis-tutorial-4-int2dh-anti.html

Malware Analysis Tutorial 5- Int 2D in Max++ (Part III) .
Link: http://fumalwareanalysis.blogspot.com/2011/10/malware-analysis-tutorial-5-int2d-anti.html

Malware Analysis Tutorial 6- Self-Decoding and Self-Extracting Code Segment .
Link: http://fumalwareanalysis.blogspot.com/2011/12/malware-analysis-tutorial-6-analyzing.html

Malware Analysis Tutorial 7: Exploring Kernel Data Structure .
Link: http://fumalwareanalysis.blogspot.com.es/2011/12/malware-analysis-tutorial-7-exploring.html

Malware Analysis Tutorial 8: PE Header and Export Table .
Link: http://fumalwareanalysis.blogspot.com/2011/12/malware-analysis-tutorial-8-pe-header.html

Malware Analysis Tutorial 9: Encoded Export Table .
Link: http://fumalwareanalysis.blogspot.com/2011/12/malware-analysis-tutorial-9-encoded.html

Malware Analysis Tutorial 10: Tricks for Confusing Static Analysis Tools .
Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html

Malware Analysis Tutorial 11: Starling Technique and Hijacking Kernel System Calls using Hardware Breakpoints .
Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-11-starling.html

Malware Analysis Tutorial 12: Debug the Debugger - Fix Module Information and UDD File .
Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-12-debug.html

Malware Analysis Tutorial 13: Tracing DLL Entry Point .
Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-tutorial-13-tracing-dll-entry.html

Malware Analysis Tutorial 14: Retrieve Self-Decoding Key .
Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-14-retrieve.html

Malware Analysis Tutorial 15: Injecting Thread into a Running Process .
Link: http://fumalwareanalysis.blogspot.com/2012/02/malware-analysis-tutorial-15-injecting.html

Malware Analysis Tutorial 16: Return Oriented Programming (Return to LIBC) Attack .
Link: http://fumalwareanalysis.blogspot.com/2012/02/malware-analysis-tutorial-16-return.html

Malware Analysis Tutorial 17: Infection of System Modules (Part I: Randomly Pick a Driver).
Link: http://fumalwareanalysis.blogspot.com/2012/02/malware-analysis-tutorial-17-infecting.html

Malware Analysis Tutorial 18: Infecting Driver Files (Part II: Simple Infection) .
Link: http://fumalwareanalysis.blogspot.com/2012/02/malware-analysis-tutorial-18-infecting.html

Malware Analysis Tutorial 19: Anatomy of Infected Driver
Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-analysis-tutorial-19-anatomy-of.html

Malware Analysis Tutorial 20: Kernel Debugging - Intercepting Driver Loading .
Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-analysis-tutorial-20-kernel.html

Malware Analysis Tutorial 21: Hijacking Disk Driver
Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-analysis-tutorial-21-hijack.html

Malware Analysis Tutorial 22: IRP Handler and Infected Disk Driver
Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-analysis-tutorial-22-irp.html

Malware Tutorial Analysis 23: Tracing Kernel Data Using Data Breakpoints
Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-tutorial-analysis-23-tracing.html

Malware Analysis Tutorial 24: Tracing Malicious TDI Network Behaviors of Max++ 
Link: http://fumalwareanalysis.blogspot.com/2012/04/malware-analysis-tutorial-24-tracing.html

Malware Analysis Tutorial 25: Deferred Procedure Call (DPC) and TCP Connection
Link: http://fumalwareanalysis.blogspot.com/2012/04/malware-analysis-tutorial-25-deferred.html

Malware Analysis Tutorial 26: Rootkit Configuration
Link: http://fumalwareanalysis.blogspot.com/2012/04/malware-analysis-tutorial-26-rootkit.html

Malware Analysis Tutorial 27: Stealthy Loading of Malicious Driver 
Link: http://fumalwareanalysis.blogspot.com/2012/05/malware-analysis-tutorial-27-stealthy.html

Malware Analysis Tutorial 28: Break Max++ Rootkit Hidden Drive Protection
Link: http://fumalwareanalysis.blogspot.com/2012/05/malware-analysis-tutorial-28-break-max.html

Malware Analysis Tutorial 29: Stealthy Library Loading II (Using Self-Modifying APC)
Link: http://fumalwareanalysis.blogspot.com/2012/06/malware-analysis-tutorial-29-stealthy.html

Malware Analysis Tutorial 30: Self-Overwriting COM Loading for Remote Loading DLL
Link: http://fumalwareanalysis.blogspot.com/2012/06/malware-analysis-tutorial-30-loading.html

Malware Analysis Tutorial 31: Exposing Hidden Control Flow
Link: http://fumalwareanalysis.blogspot.com/2012/08/malware-analysis-tutorial-31-exposing.html

Malware Analysis Tutorial 32: Exploration of Botnet Client
Link: http://fumalwareanalysis.blogspot.com/2012/08/malware-analysis-tutorial-32.html

Malware Analysis Tutorial 33: Evaluation of Automated Malware Analysis System I (Anubis) 
Link: http://fumalwareanalysis.blogspot.com/2012/09/malware-analysis-tutorial-33-evaluation.html

Malware Analysis Tutorial 34: Evaluation of Automated Malware Analysis Tools CWSandBox, PeID, and Other Unpacking Tools
Link: http://fumalwareanalysis.blogspot.com/2012/10/malware-analysis-tutorial-34-evaluation.html

Author: Dr. Xiang Fu

Saludos