Is learning assembly enough to become a malware analyst? [closed]

Question

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst.

I know it is not enough to just know how to read assembly to become a malware analyst. But won't it help a lot and make the remaining things easier?

Answer 1

To be a malware analyst, the minimum knowledge typically needed is:

• Assembly language
• Operating system internals
• Deobfuscation and anti-anti-debugging techniques

Obviously, there are other useful areas of knowledge for malware analysis (like an understanding of network protocols, exploit analysis techniques, knowledge of VB P-code and JavaScript and .NET languages, etc.), but it looks like you're making progress ;)

Most of the things you'll need to know you'll learn along the way. For example, you may come across a malware sample that exploits Adobe Flash player. This will give you the opportunity to learn about the SWF file format, ActionScript source and bytecode, etc.

Answer 2

FROM SANS.ORG

When discussing malware analysis, There is 3 main phases of the process: behavioral analysis, code analysis and memory analysis.

Here's a brief outline of each phase:

• Behavioral analysis

  examines the malware specimen's interactions with its environment: the file system, the registry (if on Windows), the network, as well as other processes and OS components. As the malware investigator notices interesting behavioral characteristics, he modifies the laboratory environment to evoke newcharacteristics. To perform this work, theinvestigatortypically infects the isolated system while having the necessary monitoring tools observe the specimen's execution. Some of the free tools that can help in this analysis phase are Process Monitor, Process Explorer, RegShot and Wireshark. Several free on-line tools can automate some aspects of behavioral analysis; there are also several free frameworks you can use to script the analysis process in a local lab.

• Code analysis

  reverse-engineers the malicious program to understand the code that implements the specimen's behavior. When looking at compiled programs, this process involves using a disassembler, a debugger and, perhaps, a decompiler to examine the program's low-level assembly or byte-code instructions.A disassembler converts the instructions from their binary form into the human-readable assembly form. A decompiler attempts to recreate the original source code of the program. A debugger lets the analyst step through the most interesting parts of the code, interacting with it and observing the effects of its instructions to understand their purpose. OllyDbg and IDA Pro Freeware are popular free disassembler/debuggers that can handle Windows programs.

• Memory analysis

  examines memory of the infected system to extract artifacts relevant to the malicious program. In the context of reverse-engineering malware, memory analysis can help identify malicious code that is trying to hide itself (i.e., rootkits), can clarify the program's run-time dependencies, and can explain how the specimen was used on the victim's system. Memory analysis saves time and allows theinvestigatorto take shortcuts when studying the specimen's behavior or code. Free tools for performing memory analysis are The Volatility Framework and its malware-related plugins, as well as Memoryze and the associated Audit Viewer program.

I Hope this would be an added Value to the above response

Answer 3

When I started with Malware Analyses at some anti-virus vendor. I only had reversed a couple of aspects of video games and created a number of tools to extract graphics etc. I also knew a fair bit of malware culture etc.. Read a lot of Malware source code (vxheavens) and all that jazz.

I however, didn't know about Obfuscation, unpacking, shellcode etc. This is something I learned over the course of a few years while on the job.

However, a SOLID understanding of x86 and your debugging / dis-assembler is required!