Tag Info

New answers tagged

1

To put it simply, an attacker can create an executable that has an encrypted virus inside of it. When the executable is downloaded to the victims machine it is not detected as a virus because the bad part is encrypted. When the user clicks on the file, The outer executable will load the encrypted data in memory and decrypt it, then execute it, all using RAM ...


2

Executable file encryption is rather obfuscation than real encryption, since encrypted file still have to execute. So "decryptor" part has to know the decryption algorithm and/or key. Antivirus software has: various emulators, for x86 code, x64 code, normalized JavaScript code etc. various decryptors/unpackers for all "crypters" and archives known to ...


0

You could have a Virtual Machine set up, and buy subscriptions to/download the free versions of all the anti-virus engines you like (for instance, the list VirusTotal has), install them one at a time (making sure to turn off all the automatic features except updating - no on-line scanning, no email integration, no Web Toolbar, no SafeSearch, no URL checking, ...


3

I worked at antivirus industry 12 years ago, so I'll try to explain, but it is possible that my knowledge is a bit outdated. Each serious antivirus vendor has antivirus lab, whose work is split to: detect new viruses and develop solutions for them: signatures, behavioral patterns for heuristic detection, specialized detection code, sometimes cleaning code ...


0

The antivirus product have different techniques to check if a given file is malicious or not. The most common technique is to check the file signature against the virus database. If there is a match then the file is considered malicious else not. Antivirus products examine a file and create a signature of it, depending upon the characteristics of the file. ...


0

From my experience with Trojans such as Cryptowall everything attached with a drive letter is substitutable to attack. Personally I lost everything including my cloud backup as it encrypted all files, even those sitting in the cloud. The best solution to protect your data is non-network connected mediums such as tape or Blue-Ray (small backups). Tape being ...


1

The two previous posts give great advice. Here are the areas I would focus on: 1. C and Assembly Languages - Critical you know Assembly like a second language 2. Debuggers - WinDBG and gdb - A debugger will be your best friend 3. Windows and Linux Internals - You must know exactly how the target system works so you can identify exactly what the malware ...


0

Your book list is a great start. pss' advice to look at the job specs is great as well as his other points. There is nothing like doing, though. To start doing, I suggest starting with crackme (reverse engineering) exercises and some packet analysis exercises. Not only will you learn about malware analysis, you will learn a whole lot about related ...


0

A malware analyst is supposed to be able to perform deep analysis of a malware and provide a signature so that the antivirus software can detect that malware. (This is the reason why antivirus software companies would like to hire you) In order to analyse a malware you might need to have knowledge of reverse engineering. Reverse engineering is a huge topic ...



Top 50 recent answers are included