Malware analysis fundamentals: strings, strace, ltrace
Static and behavioural analysis.
Level 301 · 18 lessons · 15 practice labs
Lessons
A safe start
- A safe analysis environment and its rules: You will understand the isolated analysis environment and the rules you follow to study a suspicious file without harming your own systems.
- Identifying a file's type and fingerprint with file and sha256sum: You will find a file's real type and its unique fingerprint (hash), and see why trusting the file extension is not enough.
- Looking up the hash in threat intelligence: the first five minutes
- Short task: build an ID card for three suspicious files
Static examination
- Inspecting ELF headers with readelf: You will learn to read the ELF header of Linux executables and see which architecture and structure the file was built for.
- Pulling indicators from embedded strings with strings: You will learn to pull defence-relevant indicators, such as addresses and file paths, out of text embedded in a file.
- Recognising packed binaries: entropy and UPX: You will tell from an entropy measurement and the UPX signature whether a file was compressed to hide its contents.
- Guessing capabilities from imported functions with nm and objdump
- Finding similar samples with YARA rules: You will write a YARA rule from strings and bytes of a sample you analysed and scan a folder for files from the same family.
- Short task: recognise a packed sample and unpack it with UPX
Behavioural analysis
- Watching behaviour with strace: You will learn to use strace in an isolated environment to observe which files and network a program touches and understand its behaviour.
- Library calls with ltrace: You will learn to see the library calls a program makes with ltrace and gather clues about what it is trying to do.
- Documenting behaviour and file changes with strace: You will learn to note down observed behaviour and file system changes in an orderly way, in a record someone else can repeat.
- Seeing which addresses a sample tries to reach in an isolated network
- Short task: list the files and processes a sample creates
Reporting
- Extracting and reporting indicators (IoCs): You will learn to extract indicators (IoCs) that defenders can search for from an analysis and share them in a clear report.
- Mapping behaviours to MITRE ATT&CK techniques
- Capstone: an analysis report on a suspicious file with strace: Capstone: you examine a fictional company's suspicious file in a safe environment and gather its behaviour and indicators into a short analysis report.
Practice labs
- Produce a suspicious file's identity card: Write the type, size and SHA-256 hash of three inert training samples into a table.
- Look up the hash in a local intelligence list: Look up the samples' hashes in the in-lab indicator list and report the family label of the match.
- Audit the analysis environment rules: Audit network isolation, snapshots and sample storage rules in the lab analysis environment and write the gaps.
- Read an ELF header: Extract the sample's architecture, entry point and sections with readelf.
- Extract indicators from embedded strings: Pick out addresses, file paths and commands from strings output and write them to an indicator list.
- Guess capabilities from imported functions: List the imported functions with nm and objdump and estimate the sample's network, file and process capabilities with reasons.
- Recognise packing from entropy: Measure the entropy of three files and identify the packed one.
- Unpack a UPX-packed sample: Recognise the packed training sample, unpack it with UPX and compare string counts before and after.
- A YARA rule that finds similar samples: Write a YARA rule from shared strings and show it catches only the three related samples in a set of twenty files.
- Trace system calls with strace: Run the inert sample under strace in the isolated lab and list the files it opens.
- List the files and processes created: From strace output extract the files the sample creates, the processes it starts and the permissions it changes.
- See the addresses it tries to reach: Capture the sample's DNS queries and connection attempts on the isolated network and show with ltrace which function makes them.
- Gather the indicators in one table: Write the hash, file path, domain and address indicators from an analysis into a table by type.
- Map behaviours to ATT&CK: Map five observed behaviours to the relevant MITRE ATT&CK technique and attach the evidence line.
- The analysis report of a suspicious file: Write a report for the inert training sample under static findings, behaviour, indicators and defensive recommendations.
About this course
Static and behavioural analysis.
What you will learn
- A safe start
- Static examination
- Behavioural analysis
- Reporting
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.