Course materials for Malware Analysis | Hacker News Reader

Course materials for Malware Analysis

github.com

99 pointsadamnemecek10 comments

Very interesting! Are you going to publish lecture slide or more better notes? Would be great and highly appreciative.

I know that Win* are more popular for malware therefore lectures. But by any chance are you considering doing something similar for nix*?

Thanks for putting it on line!

The lecture slides are released. If you're looking for more detail, I highly recommend the Practical Malware Analysis book! There are also additional books recommended in the readme for the class.

We've talked a little about doing something *nix, but I don't think we will have the time until maybe the Summer, as all of us 3 authors are full-time students.

Thanks for recommendation! It seems more like win focused book. Maybe you have books recommendation for nix*?

https://www.gnu.org/fun/jokes/evilmalware.html

*nix doesn't have that much malware so there are fewer materials about it.

A while ago there was a Coursera course about malware on Linux and Android. If I remember correctly they already repeated the course once or twice, maybe they'll repeat it again. I can recommend it, especially the assembler assignments were fun. https://www.coursera.org/course/malsoftware

How one gets into anti-malware/virus business nowadays? I mean, e.g. you have to get a signatures database somewhere - are these available on the market?

You can get ClamAV's database files. Though most AVs are cloud based now. They store the hash database online and the clients just query it. Most integrate sandboxes with heuristics for malicious behavior (for unseen samples) and machine learning on previously malicious samples to create rules for new detections. Most will also monitor network traffic and have rules for detection there too.

That seems like a terrible idea... hashes are small, and I should be able to run an AV scan without connecting to the net.

VirusTotal is a good start if you're willing to fork out $$.

After that you can find companies who will sell you feeds.

After you've up and running on people's computers there are sample sharing agreements between AV companies, but you need to have something of your own to share before they're going to give you theirs.

Reply on news.ycombinator.com