Original subtitles

1

Welcome to our last lesson of Introduction to Malware Analysis

2

Step 1. We already talk about social engineering campaigns we might add that the atackers use pishing, fake

3

mails, free antivirus, books, and pirated software, all of them to trick users into download malware.

4

Infected websites, those are specially scary because you are inocently surfing the internet and you don’t know

5

if the site was infected with malvertising or maybe cross site scripting,

6

Malvertising is malicious advertising, and uses legitimate online advertising services to spread malware.

7

Cross site scripting infect an online site then if you visit that site you could get infected.

8

As a general rule be carefull the address is https, if you are sending sensitive data, and keep updated your

9

navigator and antivirus. And of course sharing infected files

10

Step 2 dropper, deliver the payload to directly install malware, for example if you open a word document and execute a macro this could

11

contain a payload which will install malware directly in your system.

12

contain a payload which will install malware directly in your system.

13

Downloader, this malware installs a connection to a CC and try to download more malware,

14

a famous one is Upatre, is a very nasty malware. Persistence, to achieve persistence a malware could install services,

15

modifiy the regedit, use startup folder, install in bios and more.

16

Step3, payload is the malaware code, the bomb that will actually explode

17

and infect your system, let say with a keylogger or maybe ransomware, later we'll see those two in theory and practice.

18

spread, it means the malware try to infect the equipments you are contected to. They use a technique call LATERAL MOVEMENT:

19

It goes like this: first scans active directory, this directory holds information about resources network, as users,

20

servers, printers, etc it is the first step to identify the other network resources find vulnerabilities, try to escalate privileges

21

and try to infect them.

22

and persistence again that I just explained.

23

Prevention methods. This is not a course about cyber security risks then I only will mention some basic and relevant for this course.

24

A BASIC ONE, Keep updated your antivirus and operating system, I am gonna stress the importance of a good antivirus

25

because often people prefered those ones that are free.

26

The cost of a good antivirus is around 60 dolars

27

they generally give you several licenses,

28

you could share the costs with you relatives or friends for example,

29

Expensive? I don’t think so.

30

REVEAL HIDDEN FILE EXTENSIONS IN WINDOWS. This is because attackers could try to masquerade executables in

31

pdf, word documents and more. To do so go file explorer, view and details.

32

PRIVILEGE ADMINISTRATION, it means don't give Administrator privileges indiscriminately,

33

instead grant only the privileges each user needs.

34

This prevents lateral movements and privilege escalation.

35

BACKUP YOUR DATA, you could try Data Loss Prevention Systems

36

especially usefull in case of ransomware attacks.

37

CHECK REMOVABLE MEDIA before open it, set up your AV for doing so.

38

IS WELL KNOWN Humans are the weakest cybersecurity link: keep updated your knowledge about cyber risks,

39

if you are in charge of a team encourage training to enforce safe behaviors,

40

some advices: check twice email links and attachments, Ignore online deals,

41

be aware of pishing, try to visit trusted pages.

42

PROOF YOUR DEFENSES. companies that take cybersecurity seriously, hired read teaming exercises to proof their defenses,

43

read team is basically a group of pentester trying to exploit vulnerabilities in your system.

44

Also you can proof your defenses in case of ransomware attack in this web site,

45

you can find the address in Ransomware help document.

46

types of analysis, static and dynamic analysis

47

static, It means inspecting the file’s binary without executing it. It is the first and basic step in your analysis. Its main purpose is to extract

48

useful information from the malware, to make assumptions about the type of threat you are dealing with. Also, should give us a clue on the

49

path to take, on later analysis. Knowing things like the type of file, text strings or apis present in the binary, will be useful to understand what

50

could be its possible behavior and what tools we’ll need for further analysis.

51

Dynamic analysis, Dynamic means the malicious code is alive or running and executing all its functionalities, then we can

52

search for suspicious activities in: file system, regedit, network, processes, and services. Analyzing runtime malicious code could be

53

dangerous, then we are taking all possible precautions. That's why we set up our lab in Section Setting up the Lab, this way we can

54

run any malware safely.

55

please join me on the next section, we'll set up a safe lab to execute our malware samples