Targeted malware reverse engineering

Participants ‘learn by doing’, using the hands-on virtual lab to work on fresh targeted malware samples used in the wild by powerful APT actors.

Get to know the advanced features of tools like IDA Pro and develop up to date knowledge through recent APT cases.

Kaspersky experts have poured more than 10 years of reverse engineering experience and their exclusive research into the course.

Built for Tier 2 Analysts

Intermediate

$1,400 inc. tax per learner

Intermediate

$1,400 inc. tax per learner

Background

Skilled reverse engineers aren’t born – they’re made by experience. If you are a cybersecurity specialist with a good understanding of malware analysis methodologies & tools and are looking for more confidence in applying your skills, you can bridge the gap by working hands-on with real-life cases.

With this challenge in mind, our intermediate-level course is built around analysis of 10 targeted malware cases used in the wild by powerful APT actors recently. Cases including MontysThree, LuckyMouse & Lazarus have been researched personally by our trainers as part of their work in the Kaspersky GReAT team – so you will get first-hand knowledge and best practices from their exclusive research.

By working in the dedicated virtual lab, using an array of tools like IDA Pro, Hex-Rays decompiler, Hiew, 010Editor and many others, you will gain practical experience analyzing real-life targeted malware and will become a more efficient malware analyst and reverse engineer and prove your skills are relevant to today’s threat landscape.

Course leaders

Denis Legezo,

Security Researcher

Denis Legezo is a GCFA certified Security Researcher. He specializes in targeted attack research, static reverse engineering. Denis regularly provides training on these subjects and has presented his targeted malware research at SAS, RSA Conference, Virus Bulletin, HITB.

Ivan Kwiatkowski,

Security Researcher

Ivan Kwiatkowski is an OSCP and OSCE-certified penetration tester and malware analyst. He maintains an open-source dissection tool for Windows executables and his research has been presented during several cybersecurity conferences. He operates an exit node of the Tor network and also delivers reverse-engineering training in Europe.

Overview & objectives

Analyze real-life malware
Reverse-engineer malicious documents and exploits
Approach reverse engineering programs written in a number of languages and compiled for different architectures
Become more familiar with assembly
Master advanced features of reverse-engineering tools, understand steganography
Handle obfuscated or encrypted content
Understand the roundabout ways attackers launch their programs
Analyze shellcodes

Syllabus

Introduction and Chafer

Meet your trainers and get to know the course in more depth. Then go in to the Chafer APT to learn more about encryption algorithms (Windows CryptoAPI) and how enumerators and debug data help to understand the code.

LuckyMouse

Combination of static and dynamic analysis: how to use disassembler and debugger in parallel & how to dump decrypted data from memory.

Biodata Exploit

Exploited documents analysis. The tricks in position independent code. Get to know the exploit stages: egg-hunting, decryption, dynamic functions’ address resolution.

Topinambour

Meet interpreted code and understand how it differs from compiled code. Static and dynamic script deobfuscation.

Biodata Trojan

Using IDA Pro’s scripting abilities to automate string decryption.

DeathStalker

How LNK-based infection chains work and how to deobfuscate PowerShell scripts.

MontysThree

Reversing steganography algorithms, importing the custom structure descriptions, exporting embedded encryption keys and scratching the surface of C++.

Lazarus Group

Reverse-engineering x64 malware and reconstructing a custom network protocol from a malware sample.

Cloud Snooper

Reverse-engineering Linux programs including backdoors and rootkits.

Cycldek’s Triad

Reverse-engineering Linux programs including backdoors and rootkits.

Who's it for

InfoSec professionals

The course is intended for security researchers and incident response personnel or students, malware analysts, security engineers, network security analysts, APT hunters and IT security staff working in SOCs who are seeking to expand their skills in reverse-engineering.

Enterprises

Whether you’re looking to up-skill your current cybersecurity or SOC team or create a new in-house unit, this course will considerably improve your organisation’s defences against targeted malware.

Cybersecurity consultancies

Specialist consultancies who need to train their team on relevant practical skills to be able to offer malware analysis services to their clients will also benefit from this course.

How you'll learn

Video lectures featuring Kaspersky researchers

Learn from Ivan Kwiatkowski and Denis Legezo, Security Researchers.

Hands-on virtual lab

Learn how to use tools like IDA Pro through real targeted malware cases like Lazarus, LuckyMouse and MontysThree in our fully configured virtual lab.

Iterative learning

The course is structured around progressive learning with a consistent module framework based on specialist overviews of each task, practical work in the virtual lab and detailed solution walk-throughs.

Team training

With a constantly evolving threat landscape it’s vital IT security specialists keep their skills up to date. With our online training, you can learn effective threat detection and mitigation strategies from the comfort if you’re home with highly practical hands-on courses.

Benefits

Access

6 months to complete your course from activation of your access code

Language

Courses delivered in English with subtitles

Pace

Self-guided learning that fits around your life

Browser-based access to virtual lab

100 hours of virtual lab time for hands-on learning

Downloads

PDF downloads of training materials & tips

Learning environment

Browser-based via desktop, mobile & tablet

Course authors

Ivan Kwiatkowski and Denis Legezo, Security Researchers at Kaspersky GReAT

Guided videos

Over 50 videos to guide you through the course

Certificate of completion

>PDF document on a Kaspersky letterhead certifying the completion of the course, signed by the course leader(s)