恶意样本分析入门与实战

最新推荐文章于 2025-03-12 11:56:22 发布
最新推荐文章于 2025-03-12 11:56:22 发布
阅读量1.8k 收藏 17
点赞数 42
文章标签： 安全威胁分析 网络安全 系统安全 恶意软件
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.youkuaiyun.com/pandazhengzheng/article/details/136468001
版权

前言

今天给大家再分享一些恶意软件分析入门与实战的一些学习资料，大家在家呆着没事，可以多多学习，不要浪费青春，多做一些有意义的事，一起努力，相信明天一定会更好，未来一定会更好！

很多新人常常问笔者，怎么入门恶意软件分析，需要看什么书籍，之前笔者整理过，可以按照下面的顺序进行学习

如果没有汇编基础的，可以从上到下进行学习，如果有基础的，可以根据自身的需求，选择性进行学习

恶意软件分析工具

Windows平台恶意样本分析工具

https://malwareanalysis.co/resources/tools/windows/

Mac平台恶意样本分析工具

https://malwareanalysis.co/resources/tools/macos/

Linux平台恶意样本分析工具

https://malwareanalysis.co/resources/tools/linux/

Android平台恶意样本分析工具

https://malwareanalysis.co/resources/tools/android/

在线分析沙箱

Hybrid Analysis

https://malwareanalysis.co/resources/tools/android/

SNDBOX

https://app.sndbox.com/

Intezer

https://analyze.intezer.com/

App AnyRun

https://app.any.run/

anlyz.io

https://sandbox.anlyz.io/dashboard

YOMI

https://yomi.yoroi.company/

AmnpardazSandbox

http://jevereg.amnpardaz.com/

iobit

http://cloud.iobit.com/

CAPE

https://cape.contextis.com/

AVCaesar

https://avcaesar.malware.lu/

Noriben

https://github.com/Rurik/Noriben

AVC(APK分析沙箱)

https://undroid.av-comparatives.org/

威胁情报源

ThreatConnect

https://app.threatconnect.com/

IBM Xforce

https://exchange.xforce.ibmcloud.com/

RiskIQ

https://community.riskiq.com/

BlueLivCommunity

https://community.blueliv.com/#!/discover

pulsedive

https://pulsedive.com/

AbuseIPDB

https://www.abuseipdb.com/

IntelStack

https://intelstack.com/

AlienVaultOTX

https://otx.alienvault.com/

MISP

https://www.misp-project.org/

OpenCTI

https://github.com/OpenCTI-Platform/opencti

MalDatabase

https://maldatabase.com/

Threatfeeds

https://threatfeeds.io/

ThreatPipes

https://www.threatpipes.com/

Shodan

https://www.shodan.io/

Censys

https://censys.io/

一些有用的Cheat Sheets表

Hunting Process Injection by Windows API Calls

https://malwareanalysis.co/wp-content/uploads/2019/11/Hunting-Process-Injection-by-Windows-API-Calls.pdf

List of FileSignatures

https://en.wikipedia.org/wiki/List_of_file_signatures

APT Groupsand Operations

https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/pubhtml#

RansomwareOverview

https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml

APTnotes

https://github.com/kbandla/APTnotes

PDF Tricks

https://github.com/corkami/docs/blob/master/PDF/PDF.md

PE101

https://github.com/corkami/pics/blob/master/binary/pe101/pe101.pdf

WindowsForensics Analysis

https://www.sans.org/security-resources/posters/windows-forensic-analysis/170/download

WindowsArtifact Analysis

https://blogs.sans.org/computer-forensics/files/2012/06/SANS-Digital-Forensics-and-Incident-Response-Poster-2012.pdf

NetworkForensics and Analysis Poster

https://www.dfir.training/resources/downloads/cheatsheets-infographics/239-network-forensics-sans/file

CommonPorts

https://packetlife.net/media/library/23/common-ports.pdf

IDA ProShortcuts

https://www.hex-rays.com/products/ida/support/freefiles/IDA_Pro_Shortcuts.pdf

MalwareAnalysis Cheat Sheet

https://digital-forensics.sans.org/media/malware-analysis-cheat-sheet.pdf

AnalyzingMalicious Documents

https://zeltser.com/media/docs/analyzing-malicious-document-files.pdf

Tips forReverse Engineering Malicious Code

https://zeltser.com/media/docs/reverse-engineering-malicious-code-tips.pdf

ARMAssembly

https://azeria-labs.com/assembly-basics-cheatsheet/

Dalvikopcodes

http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html

恶意样本分析书籍

Practical Malware Analysis

https://malwareanalysis.co/wp-content/uploads/2019/09/Practical_Malware_Analysis.pdf

The IDAPro Book-2nd Edition

https://malwareanalysis.co/wp-content/uploads/2019/09/The-IDA-Pro-Book-2nd-Edition-2011.pdf

The Art ofMemory Forensics

https://malwareanalysis.co/wp-content/uploads/2019/09/The-Art-of-Memory-Forensics.pdf

MalwareAnalyst Cookbook

https://malwareanalysis.co/wp-content/uploads/2019/09/Malware-Analysts-Cookbook.pdf

PracticalReverse Engineering

https://malwareanalysis.co/wp-content/uploads/2019/09/Practical-Reverse-Engineering.pdf

Rootkitsand Bootkits

https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation/dp/1593277164/

Art ofComputer Virus Research and Defense

https://www.amazon.com/The-Computer-Virus-Research-Defense/dp/0321304543

Reversing:Secrets of Reverse Engineering

https://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam/dp/0764574817

LearningMalware Analysis: Explore the concepts, tools, and techniques to analyze andinvestigate Windows malware

https://www.amazon.com/Learning-Malware-Analysis-techniques-investigate/dp/1788392507

MasteringMalware Analysis

https://www.amazon.com/Mastering-Malware-Analysis-combating-cybercrime/dp/1789610788

MalwareData Science

https://www.amazon.com/Malware-Data-Science-Detection-Attribution/dp/1593278594

PracticalBinary Analysis

https://www.amazon.com/Practical-Binary-Analysis-Instrumentation-Disassembly/dp/1593279124

WindowsInternals 7th Edition

https://www.amazon.com/Windows-Internals-Part-architecture-management/dp/0735684189/

https://www.amazon.com/Windows-Internals-Part-2-7th/dp/0135462401

PracticalPacket Analysis 3rd Edition

https://malwareanalysis.co/wp-content/uploads/2019/10/Practical-Packet-Analysis-Using-Wireshark-to-Solve-Real-World-Problems.pdf

AndroidMalware and Analysis

https://malwareanalysis.co/wp-content/uploads/2019/12/Android_Malware_and_Analysis.pdf

AndroidSecurity Internals

https://malwareanalysis.co/wp-content/uploads/2019/12/Android_Security_Internals.pdf

恶意样本培训课程

Intro to Malware Analysis and Reverse Engineering

https://www.cybrary.it/course/malware-analysis/

FOR610:Reverse-Engineering Malware: Malware Analysis Tools and Techniques

https://www.sans.org/course/reverse-engineering-malware-malware-analysis-tools-techniques

MalwareAnalysis Master Course

https://www.fireeye.com/services/training/courses/malware-analysis-master-course.html

CertifiedMalware Reverse Engineer

https://www.crest-approved.org/examination/malware-reverse-engineer/index.html

ARES(Advanced Reverse Engineering of Software)

https://www.elearnsecurity.com/course/advanced_reverse_engineering_of_software/

RPISEC

https://github.com/RPISEC/Malware

MalwareDynamic Analysis / Reverse Engineering Malware

http://opensecuritytraining.info/MalwareDynamicAnalysis.html

http://opensecuritytraining.info/ReverseEngineeringMalware.html

PracticalMalware Analysis Labs

https://github.com/mikesiko/PracticalMalwareAnalysis-Labs

Zero 2Hero

https://www.sentinelone.com/lp/zero2hero/

论坛

KernelMode

https://www.kernelmode.info/forum/

Reddit

https://www.reddit.com/r/ReverseEngineering/

HackForums

https://hackforums.net/

oxooSec

https://0x00sec.org/ 

博客

MalwareTech

https://www.malwaretech.com/

MalwareTraffic Analysis

https://www.malware-traffic-analysis.net/

LennyZeltser Blog

https://zeltser.com/blog/

hasherezade’s 1001 nights

https://hshrzd.wordpress.com/

FireEyeBlog

https://www.fireeye.com/blog.html

VirusBayBlog

https://www.blog.virusbay.io/

CyberBitBlog

https://www.cyberbit.com/blog/

CybereasonBlog

https://www.cybereason.com/blog

MalwareMust Die

https://blog.malwaremustdie.org/

Unit42Palo Alto

https://unit42.paloaltonetworks.com/

EnsiloBreaking Malware

https://blog.ensilo.com/topic/ensilo-breaking-malware

LukasStefanko Blog

https://lukasstefanko.com/

GhettoForensics

http://www.ghettoforensics.com/

Modexp

https://modexp.wordpress.com/

Hexacorn

http://www.hexacorn.com/blog/

Fumik0_’s box

https://fumik0.com/

[系统安全] 五十八.恶意软件分析 (10)利用火绒安全实现恶意样本家族批量标注（含学术探讨）
杨秀璋的专栏
04-26 799
前文介绍了利用MS Defender实现恶意样本家族批量标注。这篇文章将讲解如何利用火绒实现恶意样本家族批量标注，在通过VS、VT采集批量样本后，通常需要样本家族标注，如何准确识别家族类别至关重要，其将为后续的恶意软件家族分类或溯源提供帮助。在此感谢李师弟热心的指导和帮助，基础性基础，希望您喜欢，且看且珍惜。
[网络安全提高篇] 一二八.恶意软件分析之利用MS Defender实现恶意样本家族批量标注（含学术探讨）
杨秀璋的专栏
04-24 784
前文介绍了IDA Python配置过程和基础用法，然后尝试提取恶意软件的控制流图（CFG）。这篇文章将讲解如何利用MS Defender实现恶意样本家族批量标注，在通过VS、VT采集批量样本后，通常需要样本家族标注，如何准确识别家族类别至关重要，其将为后续的恶意软件家族分类或溯源提供帮助。在此感谢李师弟热心的指导和帮助，基础性基础，希望您喜欢，且看且珍惜。
PracticalMalwareAnalysisAndLabs (病毒分析入门，包含实验环境)
11-09
PracticalMalwareAnalysis 一本入门的病毒分析丛书，而且压缩包内还包含了实验所需的所有环境，可以帮你从小白开始成长起来
恶意代码分析实战
博文视点（北京）官方博客
05-28 8026
安全技术大系 恶意代码分析实战（最权威的恶意代码分析指南，理论实践分析并重，业内人手一册的宝典） 【美】Michael Sikorski（迈克尔.斯科尔斯基）, Andrew Honig（安德鲁.哈尼克）著   诸葛建伟 姜辉 张光凯 译 ISBN 978-7-121-22468-3 2014年4月出版 定价：128.00元 732页 16开 编辑推荐 不管你是否有恶意代码
恶意代码分析实战：熊猫烧香病毒样本分析，从零基础到精通，收藏这篇就够了！
最新发布
yy1715713348的博客
03-12 925
在这里我们利用逆向界的倚天剑和屠龙刀，IDA和OD来对熊猫烧香进行逆向分析，对其内部实现的原理有个了解，因为篇幅关系不会对整个程序彻底分析，而是挑拣一些重要内容进行分析。有兴趣的可加QQ群：1145528880 （一起学习 逆向、PWN二进制安全、Web信息安全、IoT安全、游戏逆向分析原理交流）
Practical Malware Analysis Lab7
40KO的博客
03-11 731
前言 给出的恶意程序都是十分简单的类型，几乎没有阻止分析的手段，且IDA的反编译结果可读性十分好，只能说是用来了解一波恶意代码编程的方法和思路了。 Lab7-1 主要是Windows服务程序，可参考以下资料了解windows服务 1.http://soft.chinabyte.com/os/368/12251368.shtml 2.https://onew.me/2018/10/08/w...
PracticalMalwareAnalysis.pdf 英文原版
08-20
Practical Malware Analysis
一个恶意样本的分析
信息安全
08-09 4484
1.1样本信息1．样本概况 病毒名称：bea213f1c932455aee8ff6fde346b1d1960d57ff MD5: 6E4B0A001C493F0FCF8C5E9020958F38 SHA1: BEA213F1C932455AEE8FF6FDE346B1D1960D57FF CRC32: 1CD8074D 1.2测试环境及工具 2.1.1 测试环境 Windows ...
恶意代码分析与实战第0+1章学习-恶意代码分析入门+静态分析基础
m0_37442062的博客
11-04 636
恶意代码分析通用规则 1.不要过于陷入细节。大多数恶意程序会是庞大而复杂的,你不可能了解每一个细节。你需要关注最关键的主要功能。当你遇到了一些困难和复杂的代码段后,你应该在进入到细节之前有一个概要性的了解。 2.其次,请记住对于不同的工作任务,可以使用不同的工具和方法。这里没有一种通吃的方法。每一种情况是不同的,而你将要学习的各种工具和技术将有类似的,有时甚至重叠的功能。如果你在使用一个工具...
恶意代码分析入门--静态分析（chapter1_Lab01-01）
书山有路勤为径，学海无涯苦作舟
11-18 1157
由于dll文件是不能够直接自己来运行的，所以，必须借助exe的外力在后台运行。先看Lab01-01.exe 可以知道并且推测，由于数字1和字母l 在windows中长得太像了，所以可以推测这个程序将Lab-01-01.dll文件改名成了Kerne123.dll文件，实现伪装隐藏。去查询ip.cn发现这是一个内网地址，可见病毒作者处于教学的目的，只随便写了一个内网地址，如果他是一个公网地址，那就很有可能在后台访问这个ip进行一些危险操作。的时间戳，表明了程序是什么时间编译的。如果是，是哪些导入函数？
Practical Malware Analysis 无水印pdf
09-25
Practical Malware Analysis 英文无水印pdf pdf所有页面使用FoxitReader和PDF-XChangeViewer测试都可以打开 本资源转载自网络，如有侵权，请联系上传者或csdn删除 本资源转载自网络，如有侵权，请联系上传者或csdn删除
《恶意代码分析实战》官方实验样本
01-13
学习恶意代码分析，从官方下载的《恶意代码分析实战》课后实验样本。
practical malware analysis
09-18
网络与软件安全的经典之作，原版英文书的扫描版，老师给推荐的书
PRACTICAL MALWARE ANALYSIS
02-04
PRACTICAL MALWARE ANALYSIS The Hands-On Guide to Dissecting Malicious Software
新变种Emotet恶意样本分析
PwnGuo的博客
12-08 1167
样本信息 表1.1 样本信息表 文件 大小 190976 字节 修改时间 2021年12月2日, 10:30:02 MD5 2EFBE18F2ED8AE0D4648B68596DFA00C SHA1 0954D1E4BC63EB075703FB3D40B5CDB06F57E61E CRC32 8969E72E ...
Practical Malware Analysis
09-26
Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring. For those who want to stay ahead of the latest malware, Practical Malware Analysis will teach you the tools and techniques used by professional analysts. With this book as your guide, you'll be able to safely analyze, debug, and disassemble any malicious software that comes your way. You'll learn how to: Set up a safe virtual environment to analyze malware Quickly extract network signatures and host-based indicators Use key analysis tools like IDA Pro, OllyDbg, and WinDbg Overcome malware tricks like obfuscation, anti-disassembly, anti-debugging, and anti-virtual machine techniques Use your newfound knowledge of Windows internals for malware analysis Develop a methodology for unpacking malware and get practical experience with five of the most popular packers Analyze special cases of malware with shellcode, C++, and 64-bit code Hands-on labs throughout the book challenge you to practice and synthesize your skills as you dissect real malware samples, and pages of detailed dissections offer an over-the-shoulder look at how the pros do it. You'll learn how to crack open malware to see how it really works, determine what damage it has done, thoroughly clean your network, and ensure that the malware never comes back. Malware analysis is a cat-and-mouse game with rules that are constantly changing, so make sure you have the fundamentals. Whether you're tasked with securing one network or a thousand networks, or you're making a living as a malware analyst, you'll find what you need to succeed in Practical Malware Analysis.
Practical Malware Analysis Lab9
40KO的博客
03-15 677
Lab9-1 不走程序直接逆。标注完的主函数如下 int __cdecl main(int argc, const char **argv, const char **envp) { char port; // [sp+10h] [bp-181Ch]@31 char ups; // [sp+410h] [bp-141Ch]@31 char url; // [sp+810h] [b...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

熊猫正正

请我喝杯咖啡吧

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值