Hello friends,
currently I'm doing some Forensic challenges. These challenges are pretty cool, but I'm stuck at the harder ones (obfscation an Windows Infinity Edge). To solve these tasks, I do not want to just google or read a writeup and follow the steps described.
I want to understand what I'm doing, how specific tools are working, how an excel-document is constructed/how bad code is implemented by attackers etc.....
My questions are: Is Malware Analysis (MA) an own field of expertise or just a part of Reverse Engineering (RE)? How could I get better in MA? Are there some books, online tutorials, courses etc. for beginners? Should I first start with some basics of RE and the dive deeper into MA?
I found this post (https://forum.hackthebox.eu/discussion/comment/51852#Comment_51852) but I don't know, whether this is the right way to start, because the focus lies on RE.
Thanks
Hello friend. Hello friend? I am always happy to help you, but also expect clear information about what you have achieved so far. Together we will raise the flag!
Remember: Giving respect is a matter of honor
Comments
Its a good question but it has a complex (IMHO) answer.
First - the forensic challenges on HTB aren't always aligned to real-world forensic practices. Its more a case that they use forensic techniques to a varying degree. I will use forget-me-not as an example (as it has retired). Yes the extraction of the string uses what could be described as memory forensics but thats about it.
So on to malware analysis. The vast majority of this uses some reverse engineering techniques but the goals are different which means the workflows can be different.
I would say that Malware Analysis is a different field to Reverse Engineering but there is overlap (for example, SANS has a course called Reverse Engineering Malware: https://www.sans.org/cyber-security-courses/reverse-engineering-malware-malware-analysis-tools-techniques/ just to muddy the waters).
It is worth noting that malware analysis ranges from trying to get some simple IOCs to use for the incident response process through to understanding the malware enough to describe what it does.
Reverse engineering is normally focused on finding out what the application does (and in the context here, working out how to exploit it). As you can see this is part of what a malware analyst needs to do and probably aligns with the needs of more advanced practitioners.
Also, a vast majority of the time, malware analysis is looking at malicious documents and scripts rather than pulling apart the internals of a PE/ELF/Mach-O file. A malware analyst is likely to be using
oletools
as much as they usegdb
. At a basic level, malware analysis can be as simple as dropping a file into PEStudio - that gets a massive amount of the information you need for DFIR.As a reverse engineer, you need a deeper understanding of the file, the ability to walk through what it is doing etc.
So, tl;dr - they are very similar. A good reverse engineer will be good at malware analysis. A good malware analyst will probably have learned reverse engineering.
I dont think it matters. If you start with RE of executables, the main MA you'd need to cover is the script/maldoc stuff. If you start with MA, then at somepoint you are going to need to learn RE.
Note: https://www.nohello.com/
Happy to help people but PLEASE explain your problem in as much detail as possible! If you say vague things like "It's not working", I cant help. This isn't Twitter so my DMs are always open.
Currently have very limited HTB time but will try to respond as quickly as possible.
The only thing I don't see fitting here is Forensics: sure MWA is part of forensics, but other way round forensics is a lot more than MWA.
There's couple of youtube channels dedicated to MWA that may give you an idea which organisations actually focus on MWA.
Type your comment> @TazWake said:
Hello. Thank's for your detailled answer.
The things you wrote about a malware analyst is the way I'm more interested. I think as a defender/blue teamer the identification of IOCs or
I interpret this to mean, that I should just start with the 'analysis' of the forensics challenges. There is no straighter path. I think I will dive deeper into some topics, when I'm doing the tasks (e.g. usage of oletools, what means OLE, Visual Basic/macros, structure of excel documents etc..... based on the challenge/topic)
Type your comment> @sparkla said:
Yeah I think you are right. MWA is a part of forensics. So (in my opinion) if you know something about forensics, forensic-tools or a general procedure, would help you to get better in MWA. Or in general: there are different fields of expertise, that are relevant, if you want to get an expert in MWA.
Edit: I found the youtube-channel of "HackerSploit". He has a playlist about MA. This looks pretty good.
Hello friend. Hello friend? I am always happy to help you, but also expect clear information about what you have achieved so far. Together we will raise the flag!
Remember: Giving respect is a matter of honor
@tXxc said:
Pretty much. On the whole I wouldn't say it matters which approach you want, if you start from Binary RE, you will need to learn Maldoc, if you start with Maldoc you need Binary RE etc.
It is an open ended field though because you learn more, you largely learn just how much more is still to go.
It is not a free resource ( it does have free trials and can be cost effective ) but it can be worth checking out Pluralsight.
The courses by Tyler Hudak (especially setting up a malware analysis lab and malicious document analysis) and Josh Stroschein (especially defeating obfuscation/packing) are very good quality.
Note: https://www.nohello.com/
Happy to help people but PLEASE explain your problem in as much detail as possible! If you say vague things like "It's not working", I cant help. This isn't Twitter so my DMs are always open.
Currently have very limited HTB time but will try to respond as quickly as possible.
Most of the IT crowd thinks the pentesting/redteaming is the sexy stuff in cybersec but that's some sexy stuff in the Blue Team and i'm actually considering diving a bit more into that.
eCPPT | OSCP
Type your comment> @TazWake said:
Thanks for the hint.
When I've got more freetime, I will watch some videos. For the beginning will youtube be my friend
Hello friend. Hello friend? I am always happy to help you, but also expect clear information about what you have achieved so far. Together we will raise the flag!
Remember: Giving respect is a matter of honor