Ethical Hacking Foundations: Malware Development in Windows from Udemy

Are you a pen tester having some experience with Metasploit or Empire frameworks? Or maybe you take your first steps as an ethical hacker and you want to know more about how all these offensive tools work? Or you are a blue teamer or threat hunter who needs to better understand the internal workings of malware?

This course will provide you the answers you're looking for. It will teach you how to develop your own custom malware for latest Microsoft Windows 10. And by custom malware we mean building a dropper for any payload you want (Metasploit meterpreter, Empire or Cobalt Strike beacons, etc.), injecting your shellcodes into remote processes, creating trojan horses (backdooring existing software) and bypassing Windows Defender AV.

You will receive a virtual machine with complete environment for developing and testing your software, and a set of source code templates which will allow you to focus on understanding the essential mechanisms instead of less important technical aspects of implementation.

What's inside

Learning objectives

What is malware development in windows
What is pe file structure
Where to store your payload inside pe
How to encode and encrypt payloads

How and why obfuscate function calls
How to backdoor programs
How to inject your code into remote processes

What is malware development in windows
What is pe file structure
Where to store your payload inside pe
How to encode and encrypt payloads
How and why obfuscate function calls
How to backdoor programs
How to inject your code into remote processes

Syllabus

Introduction

Data section as a container

Development VM Setup

Portable Executable

PE files - format and structure

PE Bear - looking inside

Generating EXE vs DLL

PE compilation

Droppers

Where to store payloads?

Storing payloads in code section

Payloads in resource section

Obfuscation and Hiding

Encoding and Encryption

HINT:

During code development you might encounter issues with string encryption/encoding. To troubleshoot these problems, check how they are constructed (i.e. how their length is calculated or comparison performed). This should lead you into solving the encountered problems.

Encrypting payloads - XOR

Encrypting payloads - AES

Antivirus vs call obfuscation

Implementing function call obfuscation

Backdoors and Trojans

Backdooring PE theory

Making Putty a trojan

Code Injection

What is code injection?

Injecting code into remote process

Implementing code injection

Loading DLLs into remote process

DLL generator and injector

Making program invisible

Summary

Course closing information

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in Ethical Hacking Foundations: Malware Development in Windows with these activities:

Review Windows System Calls

Show steps

Reviewing Windows system calls will provide a solid foundation for understanding how malware interacts with the operating system, which is crucial for development and analysis.

Browse courses on Windows API

Show steps

Identify key Windows API functions used in malware development.
Research the purpose and usage of each function.
Practice using these functions in simple C/C++ programs.

Read 'Practical Malware Analysis'

Show steps

Reading 'Practical Malware Analysis' will provide a strong foundation in malware analysis techniques, complementing the malware development skills learned in the course.

View Practical Malware Analysis: The Hands-On Guide... on Amazon

Show steps

Read the chapters on static and dynamic analysis.
Practice analyzing sample malware using the techniques described.
Relate the analysis techniques to malware development strategies.

Read 'Windows Internals, 7th Edition'

Show steps

Reading 'Windows Internals' will provide a comprehensive understanding of the Windows OS, essential for advanced malware development and reverse engineering.

View Melania on Amazon

Show steps

Read the chapters related to process management and memory management.
Take notes on key concepts and system structures.
Relate the concepts to malware development techniques.

Four other activities

Expand to see all activities and additional details

Show all seven activities

Write a Blog Post on PE File Structure

Show steps

Writing a blog post on PE file structure will reinforce understanding of the topic and help communicate the knowledge to others.

Show steps

Research the PE file format in detail.
Create diagrams to illustrate the structure.
Write a clear and concise explanation of each section.
Publish the blog post online.

Develop a Simple Keylogger

Show steps

Developing a keylogger will provide hands-on experience with Windows API calls, code injection, and data persistence, all of which are core concepts in malware development.

Show steps

Research Windows API functions for keyboard input.
Implement a function to capture keystrokes.
Store the captured keystrokes to a file.
Make the keylogger run in the background.

Practice Shellcode Encoding/Decoding

Show steps

Practicing shellcode encoding and decoding techniques will improve the ability to obfuscate and protect payloads from detection.

Show steps

Learn different encoding schemes (XOR, Base64, etc.).
Write scripts to encode and decode shellcode.
Test the scripts with various payloads.

Create a Custom Payload Dropper

Show steps

Creating a custom payload dropper will solidify understanding of PE file manipulation, payload injection, and anti-analysis techniques.

Show steps

Design the dropper architecture.
Implement the payload injection mechanism.
Implement anti-analysis techniques (e.g., anti-VM, anti-debugging).
Test the dropper against various antivirus solutions.

Career center

Learners who complete Ethical Hacking Foundations: Malware Development in Windows will develop knowledge and skills that may be useful to these careers:

Ethical Hacking Foundations

Malware Development in Windows

What's inside

Learning objectives

Syllabus

Save this course

Activities

Career center

Reading list

Share

Similar courses