001 Introduction (52.88 MB)
001 Types of Malware (31.39 MB)
002 Malware Analysis Terminologies (16.76 MB)
001 Dynamic Analysis of NET Trojan - Part 1 (50.56 MB)
002 Dynamic Analysis of NET Trojan - Part 2 (74.8 MB)
003 Static Analysis of NET Trojan - Part 1 (100 MB)
004 lab1-dotnet-trojan (455.55 KB)
004 Static Analysis of NET Trojan - Part 2 (62.91 MB)
001 Assembly Language Refresher (56.23 MB)
002 Malicious APIs (28.31 MB)
001 Using API Hooking to Analyze Malware - PandaBanker (223.59 MB)
002 Tracing Process Hijacking and Dumping Memory (173.61 MB)
003 Fixing Section Alignment, Unmapping, fixing IAT and Re-basing (130.33 MB)
010 pandabanker (107.69 KB)
012 panda-banker-dump (78.91 KB)
001 Unpacking Part 1 Static Analysis of Emotet Trojan (53.55 MB)
002 Unpacking Part 2 Debugging of Emotet Trojan to Hunt For Unpacked Code (164.3 MB)
003 Unpacking Part 3 Dumping Memory and Unmapping Dumped File (92.04 MB)
013 emotet trojan (81.5 KB)
001 IDA Static Analysis and xdbg Enumerating Breakpoints (67.4 MB)
002 API Hooking and Memory Tracing (176.34 MB)
003 Dumping Memory and Unmapping File (81.97 MB)
016 hancitor (43.86 KB)
001 API Hooking with VirtualProtect, VirtualAlloc and GetProcAddress (150.51 MB)
002 Memory Tracing and Scylla Dumping (209.76 MB)
003 PE-Studio and Interactive Delphi Reconstructor (IDR) (50.53 MB)
019 vmprotect trojan (20.26 MB)
001 Unpacking part 1 API Hooking (118.56 MB)
002 Unpacking part 2 Dumping from Memory Map (206.75 MB)
003 Unpacking part 3 Un-mapping Dumped File (56.49 MB)
022 trickbot trojan (258.3 KB)
001 Dridex - part 1 - Initial Analysis (47.52 MB)
002 Dridex - part 2 - API Enumeration Count (153.99 MB)
003 Dridex - part 3 - Self-Injection and Process Hacker Dumping (75.33 MB)
004 Dridex - part 4 - Unmapping the Dumped File (47.8 MB)
025 dridex (181.26 KB)
001 Ramnit - part 1 - Using CreateProcessInternalW to Track Child Process (94.03 MB)
002 Ramnit - part 2 - Tracking VirtualAlloc to Identify When To Dump (149.06 MB)
003 Ramnit - part 3 - Unpacking UPX with CFF Explorer (72.73 MB)
029 ramnit (1.54 MB)
001 Remcos - part 1 - exploring NET with xdbg (129.71 MB)
002 Remcos - part 2 - CreateProcessInternalW, WriteProcessMemory and NtResumeThread (92 MB)
003 Remcos - part 3 - Analysis with PE-Bear and PE-Studio (50.38 MB)
004 Remcos - part 4 - Unpacking with dnSpy by tracing Invoke (88.31 MB)
032 remcos (329.8 KB)
001 Zloader - part 1 - PE-Studio and API Hooking until VirtualProtect (80.45 MB)
002 Zloader - part 2 - Tracing Pointer to Unpacked Code for Dumping (72.11 MB)
003 Zloader - part 3 - PE-Studio and PE-Bear Analysis (27.27 MB)
036 zloader (319.08 KB)
001 Bonus Lecture (10.61 MB)