Reverse engineering malware/viruses

Question

Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already done.

It would be good to know what has been compromised, as well as look for routes to successfully remove it.

I have found tools such as IDAPro and OllyDbg, which are proving to be useful, however, I won't lie and pretend I understand what to look for, or what the data shown in each means.

What are some good resources for learning and truly comprehending the data shown in these debuggers, as well as some resources for general reverse-engineering of malware?

I am not just looking for removal tools, I'm trying to dig into the malware and see what it does.

Thanks!

Answer 1

Malware is a tricky one stuff - Malware RE is not only about disassembling or debugging - it is also about behavior, changes monitoring, etc.

I suppose you will be interested in some blogs that describes malware analysis, then you could look for them here: https://code.google.com/p/it-sec-catalog/wiki/Malware. Don't know if it is worth to mention resources about RE - there are really a lot of materials all over the internet.

Also you should consider buying following book: http://www.amazon.com/Malware-Analysts-Cookbook-DVD-Techniques/dp/0470613033/ref=wl_mb_recs_5_dp

Answer 2

Depending on what level you want to go to, the course Lenny Zeltser is doing at SANS is supposed to be very good.

Wes Brown gives a good talk here.

Paul Melson blogs about this kind of thing, and has a presentation up here.

But check the laws in your area - some types of reverse engineering are illegal in some jurisdictions, even if it is just for your own learning, so be careful!

Answer 3

Introduction to Reverse Engineering Software - covers reverse engineering on both Linux and Windows. Haven't read it all the way through yet but seems to have some good coverage.

Malware Analysis and Antivirus Technologies is a course being at Aalto University in Helsinki. They have the Chief Research Officer from f-secure giving some lectures. The first lecture was on Wednesday and they should be publishing the course material online shortly. Hopefully it will prove to provide some good resources.

Answer 4

this Blog Post will get you started in the malware analysis field Malware Analysis by Sans