Take your malware analysis skills to the next level with Malware Analyst Professional Level 2! Led by Uriel Kosayev, founder of TrainSec Academy, this course dives into advanced malware dissection, attacker methods, and reverse engineering tools like IDA Pro and x64dbg. Covering x86 architecture, Windows API analysis, code injection, packed malware, and shellcode, it equips you to excel as a professional malware analyst.
Cybersecurity researcher and red teamer who lives both on the offensive and defensive fronts. The author of the “Antivirus Bypass Techniques” book, expert in malware research, reverse engineering, penetration testing, digital forensics, and incident response
Learn practical techniques and tactics to combat, bypass, and evade antivirus software Enroll in this course and receive a 30% discount on the best-seller Antivirus Bypass Techniques book.
Antivirus software is built to detect, prevent, and remove malware from systems, but this does not guarantee the security of your antivirus solution as certain changes can trick the antivirus and pose a risk for users. This book will help you to gain a basic understanding of antivirus software and take you through a series of antivirus bypass techniques that will enable you to bypass antivirus solutions.
Take your malware analysis skills to the next level with Malware Analyst Professional Level 2, the ultimate course for mastering advanced malware dissection and reverse engineering.
Building on the foundational knowledge from Level 1, this program, led by Uriel Kosayev—founder of TrainSec Academy and an expert malware researcher—dives deep into the techniques and tools used to analyze and counter sophisticated cyber threats. The course begins by solidifying your understanding of reverse engineering, exploring x86 architecture, assembly language, memory layouts, and debugging techniques using tools like IDA Pro and x64dbg. You’ll gain practical insights into analyzing Windows API functions, understanding their role in malware behavior, and utilizing resources like MSDN documentation for in-depth analysis.
Delving into offensive tactics, the course covers code injection techniques, including CreateRemoteThread and process hollowing, providing hands-on examples of how malware manipulates processes.
You’ll also explore the self-defense mechanisms of malware, such as anti-debugging, anti-virtual machine detection, and anti-antivirus strategies, learning to identify and overcome these countermeasures. A key focus is unpacking packed malware, where you’ll practice manually unpacking real-world examples like the WannaCry ransomware and packers like UPX, PECompact, and ASPack. Finally, you’ll master shellcode analysis, dissecting and reverse engineering malicious payloads to uncover their functionality and impact.
By the end of this comprehensive program, you’ll have the expertise to dissect complex malware, understand attacker methodologies, and use industry-standard tools effectively. This course is your gateway to becoming a highly skilled malware analyst, ready to tackle the most challenging cybersecurity threats.
This section dives into the techniques and mechanisms of code injection, a common tactic used by malware to manipulate processes. It starts with an introduction to the concept of code injection and its relevance in cybersecurity. Lessons cover the classification of various injection methods, including their characteristics and use cases. The section provides an in-depth exploration of process injection techniques, such as CreateRemoteThread, which allows injecting code into remote processes, and Process Hollowing, a method for replacing legitimate code with malicious payloads. These techniques are broken down into practical steps, with examples and tools to help students identify, analyze, and counteract such methods. By the end, students gain valuable skills to detect and understand code injection, a critical component of advanced malware analysis.
This section explores the sophisticated techniques used by malware to evade detection and analysis, equipping students with the skills to counter these defensive measures. The introduction sets the stage by explaining the concept of anti-analysis tactics employed by malware. Subsequent lessons dive into anti-debugging methods that hinder debugging tools, and anti-virtual machine (anti-VM) techniques that detect and avoid running in virtualized environments. Finally, the section addresses anti-antivirus (anti-AV) strategies, illustrating how malware bypasses traditional security software. Through practical examples and detailed explanations, students gain insights into recognizing and overcoming these self-defense mechanisms, a critical aspect of malware analysis.
This section delves into the methods used to unpack and analyze packed malware, a common tactic employed by attackers to obscure their malicious code. The lessons start with an introduction to packers and the unpacking process, explaining how packing works and its role in hindering analysis. Students then analyze real-world examples, such as unpacking the infamous WannaCry ransomware, to understand these techniques in action. Practical sessions cover manual unpacking of malware packed with tools like UPX, PECompact, and ASPack, guiding students through the step-by-step process of bypassing these layers of obfuscation. By the end of this section, participants are equipped with the skills needed to effectively combat and analyze packed malware.
This section focuses on the analysis and reverse engineering of shellcode, a compact and powerful piece of malicious code used in exploitation. It begins with an introduction to shellcode analysis, explaining its purpose, structure, and role in cyberattacks. Subsequent lessons guide students through the reverse engineering process, covering practical techniques to dissect shellcode. Using step-by-step examples, the course demonstrates how to identify entry points, decode obfuscated instructions, and understand the payload’s functionality. By the end of the section, participants gain the expertise needed to analyze and counteract shellcode, a critical skill in advanced malware analysis and cybersecurity.
This section provides an in-depth exploration of ransomware analysis, focusing on the DarkSide ransomware.
Through hands-on exercises, students delve into the techniques used by ransomware developers to obfuscate and encrypt malicious payloads. Lessons cover initial analysis, identifying packed or encrypted sections, and using tools like IDA Pro to unpack and analyze runtime code.
Key topics include dynamic API resolution, rebuilding the Import Address Table (IAT), and decrypting and parsing the resource sections. Students learn to track ransomware behavior, such as machine fingerprinting, privilege escalation, and encryption routines, while also exploring methods for taking memory snapshots and reconstructing decrypted code for static analysis. This section equips learners with practical skills to dissect and understand the tactics, techniques, and procedures (TTPs) of ransomware.
This section focuses on analyzing .NET-based malware using advanced techniques. The lessons center on the SolarWinds Sunburst Backdoor, a sophisticated .NET-based threat. Students learn to decompile and examine malware using tools like dnSpy, explore function call trees, and uncover hidden malicious payloads embedded in legitimate code. Topics include understanding fingerprinting methods like concatenating machine GUIDs and MAC addresses, validating execution environments, and detecting domain-joined computers.
The course also covers how the malware conducts extensive enumeration of services, processes, and system drivers to evaluate attack viability and escalate privileges. Through step-by-step analysis, participants learn how the malware interacts with DNS and C2 servers, builds HTTP requests with disguised user agents, and exfiltrates config files containing sensitive system data. This section equips students with essential skills to dissect .NET malware and understand its stealth techniques.
From Foundations to Advanced Expertise in Malware Analysis and Reverse Engineering
The Malware Analyst Professional course is a complete training program divided into two parts: Level 1 and Level 2, designed to take you from beginner to advanced expertise in malware analysis and reverse engineering.
Starting with Level 1 is crucial, as it provides the foundational knowledge, tools, and techniques. Level 2 builds on this base, diving into advanced topics such as code injection, unpacking packed malware, analyzing shellcode, and overcoming self-defending malware.
58 Lessons
Take your malware analysis skills to the next level with Malware Analyst Professional Level 2! Led by Uriel Kosayev, founder of TrainSec Academy, this course dives into advanced malware dissection, attacker methods, and reverse engineering tools like IDA Pro and x64dbg. Covering x86 architecture, Windows API analysis, code injection, packed malware, and shellcode, it equips you to excel as a professional malware analyst.
@2025 TrainSec. All rights reserved. Terms of Use | Privacy Policy
