My journey to learn malware analysis: Part 2

Recap

On the previous post, I created learning goals around "What would malware analysis be used practically in the real world?". Now, I'm going hone into one of the learning goal: "Analyze an random application, extract indicators - Legitimate / Malicious, evaluate the Indicators -> Determine if the application is malicious or legit".

Learning “Malware Analysis” as a beginner - Part 1

Defining my learning goal Before, I start diving deep into “Malware Analysis”. I need to learn “what does an malware analyst do?” or, “How is malware analysis used practically in the real world?”. Just saying: “I want to learn malware analysis” doesn’t provide me any actionable steps or insight on

SecurityNguyenNguyen Nguyen

Breaking down the overall learning goal to small goals

Breaking the learning goal into smaller pieces allows us:

• Identify what we need to learn
• Target individual components of the overall goal.
• Keep it simple.

The overall goal: Ability to analyze an unknown application and determine if its malicious or legitimate.

Overall goal can broken down to: "Ability to identify IOCs", "Extract the IOCs", and "Evaluate the IOCs".

Ability to identify IOCs and evaluate them are closely tied together. To be able to identify IOCs, you need to understand what malicious and what's normal. You need to learn how to put indicator to form an picture of what happen.

I came up with an alternative learning goal: "Understand the different types of IOCs in a PE file and the meaning/context it brings."

Learning assessment

Learning allows me to:

• Monitor my progress.
• Reveal any gaps that I currently have.
• Change my learning activity (if no progress) has been made.
• Allows me to test my skills/ability.

Note: Your assessment should be a mini-version of the real task your goal demands.

For now, my assessment will be:

• Level 1: Given the sample provided in the current chapter, analyze it and identify as many indicators as you can find across any category, then produce a verdict — all before reading the author's analysis or the end-of-chapter questions. Once complete, answer the end-of-chapter questions without looking at the answers. Then compare both your analysis and your answers against the author's.

Learning activity

Now, I need to create an learning activity. Learning activity is the practice that you do in your learning session that allow you to develop your skills. It's derive from your assessment.

Here are the things you want to keep in mind when designing an learning activity:

• Learning activity should match with the learning assessment.
  • For example: Using flashcard with indicators on the front and on the back, and the verdict on the back is not good practice.
• Resources you have: courses, books, mentor.
  • Resources for malware analysis:
    • Samples:
      • https[://]bazaar[.]abuse[.]ch/browse/
    • Practical training resource:
      • https[://]cyberdefenders[.]org/
      • https[://]blueteamlabs[.]online/
      • https[://]app[.]letsdefend[.]io/training/malware-analyst
• How can we create an activity that allow us to target the skills/knowledge to help reach our learning goal?

Learning Activity:

• Analyze the sample at the end of each chapter, write down all the indicator you found and how did you find them? Additionally, organize the indicator and see if there any relationship you can derive from using them together.
• Write down in what scenarios is static/dynamic analysis useful in? and in what scenario it's useless in.