Introduction to Reverse Engineering Malware (SANS)

[EmilKXZ]

http://isc.sans.edu/presentations/cookie.pdf

This is an introduction to REM. The document is from a class by a knowledgeable woman, who wrote it kinda for dummies. In a nutshell, it's a good tutorial.

I would be pleased to know, if you read it... what was your reason? Let's start some good discussion on this. I'd like to know why people would be interested in such material. Whether you're applying for a job in a malware analysis lab, or learning techniques to protect your malware from those... I would like to see what arises from this discussion. Thanks! 

[Ragehottie]

Reading it now. Long trip tomorrow, ill finish it then. I've been working on a botnet for quite a while now. I finally have a version I can release and something just hit me. How can I distribute it? Trojan, yes very easy. Finding/ making a worm— even better. I would prefer to get one and modify it, and what better way to get one than to reverse engineer it? Now finding the worm..... ill cross that bridge when I come to it.

[Zesh]

or learning techniques to protect your malware from those...

This. Awhile back I started work on malware software and did quite abit of reading on techniques used by AVs but stopped work cause of motivation. But with my motivation coming back, I'll read up on this too, thanks for the share

[EmilKXZ]

I want to get into pro-reversing, (for being myself a pro-malware coder!), perhaps we could make a team? Or share stuff, samples, techniques, etc.

Well, in the wide-open Reverse Engineering forum we could hang out there and make use of it. Consider this my first contribution to it! I recommend you to start with this book, it's practical. I own a hardcopy. If you intend to buy it, don't buy the digital version, you will regret if they don't send you the DVD ISO or something. Get the hardcopy so you can study on a table with your laptop as well.

http://www.amazon.com/Malware-Analysts-Cookbook-DVD-Techniques/dp/0470613033

I am serious at this. I got hit by an attempt of phishing and I am hunting that bitch down. Can't send you a sample, I guess this forum is not for sharing infected files (I have read that in the rules). Nobody targets me, nobody. 

[Zesh]

Aha, thanks for the book share, I'm going to buy it