Kaspersky Reverse Engineering

[Julian Gladyshev]

Proficiencyin at least one scripting/programming language (ideally Python) and a basic understanding of Intel assembly language, alongside a basic understanding of reverse engineering and targeted malware, are paramount for anyone taking the course.

Denis Legezo is a GCFA certified Security Researcher. He specializes in targeted attack research, static reverse engineering. Denis regularly provides training on these subjects and has presented his targeted malware research at SAS, RSA Conference, Virus Bulletin, HITB.

Ivan Kwiatkowski is an OSCP and OSCE-certified penetration tester and malware analyst. He maintains an open-source dissection tool for Windows executables and his research has been presented during several cybersecurity conferences. He operates an exit node of the Tor network and also delivers reverse-engineering training in Europe.

Meet your trainers and get to know the course in more depth. Then go in to the Chafer APT to learn more about encryption algorithms (Windows CryptoAPI) and how enumerators and debug data help to understand the code.

Each and every month we share our latest news, tips, tricks and advice on all things cybersecurity related.

Be the first to find out when we run competitions, promotions, launch new courses, release free webinars and much more!

In 2005, while working for Hoffmann Investigations, I went to the SANS 508 forensics training in San Diego. During that time, you were still allowed to buy course material from other courses. I bought the course material for the GREM 601 course by Lenny Seltzer. I took the syllabi to my hotel room and did not participate in any social event that night as the GREM course material was just great and really opened my eyes. Later that year, I took both exams 508 and GREM and passed. Still, my knowledge about reversing was very limited due to limited exposure to real malware. In the years that followed, that would rapidly change as I have participated and led investigations into many nation-state breaches by actors originating from Iran, China, and Russia and have been tracking them with YARA ever since. A lot later, I also followed a malware reversing class from Mandiant in Washington. During those courses, the main objective was to quickly obtain relevant indicators of compromise and understand static and dynamic malware reversing. My exposure to the famous dissembler IDA was limited compared to OllyDbg or now x64dbg. So over the years, my malware reversing experience grew, but compared to real reversers, like the Kaspersky instructors Denis and Ivan in this training course, there is enough room to grow:).

Before onboarding, in this course, I first requested demo access to understand how the delivery of the course would happen virtually. After the demo access to one of the labs, I decided to onboard for the course. Once registered, you will be onboarded in the learning environment of Kaspersky training.

The total learning time is valid for 6 months. The learning environment works like a charm and is well structured and organized. One of the benefits of virtual videos is that the instructions given by Denis or Ivan are subtitled. I found this particularly useful sometimes when some shortcuts were given in IDA pro. I do miss an overview with often used keyboard shortcuts, though. What I also like is that two non-native English speakers are giving the training. Somehow their slow-paced storytelling resonated really well with me.

In most of the 10 threat actor cases, the lab is closed with a new quiz sample where you basically need to repeat your analysis steps in the virtual lab on your own and find the correct answers to the challenging questions.

I already mentioned them briefly, but the course instructors are Denis Legezo and Ivan Kwiatkowski, two experienced members of GReAT (Global Research & Analysis Team), which focuses on APT research. Denis comes from Russia, and Ivan comes from France. As mentioned earlier, both instructors are also responsible for the in-depth analysis publications on the securelist website, including some of the 10 powerful APT threat actors covered in this malware reverse engineering course. Both instructors are different in delivering the learning experience. Denis focuses on the fundamentals of IDA pro and explains really well, where Ivan demonstrates the power of automation in IDA with Python. I learned a new term from Denis, namely malefactors, a person who commits a crime or some other wrongdoing. This term is used to refer to the actors behind the malware. Furthermore, Denis calls IDA, Miss IDA, and the X64dbg, Mr. Debugger, why we will find out later in the Q&A with them.

I really enjoyed this malware training by Kaspersky as it is a very practical course in which you need to analyze multiple APT malware cases. You have a great lab environment and are free to do extra analysis on the malware cases provided. One of my main learning experiences was getting really familiar with IDA Pro and all its functionalities. Until this track, I only had access to the IDA free addition on my own virtual machine. IDA Pro makes the difference and is very useful. Also, both course instructors are basically doing all their analysis in the end with IDA Pro.

Besides this, I learned about a tool called Hiew, which can be used for all kinds of analysis tasks, but primarily for surface analysis of malware samples. During the 10 malware tracks, I was taught to reverse-engineer programs within different programming or heavily obfuscated scripting languages (C, .NET, Delphi, Powershell, JavaScript, C++). I also analyzed malware samples compiled for 64-bit architecture or different operating systems like Linux and, of course, shellcode.

One of the improvements that the course instructors could make, and I have given them that feedback already, is to make a cheat sheet with all the relevant keyboard shortcuts in IDA or other tools used. Ensure that you read the pre-requisites before onboarding this training and are familiar with scripting languages like Python.

One of the things I missed was how to track these powerful real life APT threat actors with a language called Yara, but I believe that is on purpose as Kaspersky also provides training called Hunt APTs with Yara like a GReAT Ninja. So maybe I will onboard on that training the next time to further enhance my tracking skills.

This course is not aimed at people who have no experience with malware reversing but is especially aimed at people who have already some experience with it but need to improve their game. From my professional background perspective as a manager of teams, I believe this training would help many cybersecurity specialists in their maturity journey. Also, the pricing for the offered learning environment ($1400) is very competitive compared to the SANS malware track, for example, which costs nearly $7000 depending on the delivery method.

So a definite buy, if you are a disciplined person and can systematically work online besides your day job. The learning environment is GReAT, and cases are fascinating to investigate.

During the course, students also had the opportunity to ask questions about the course and interact with the course instructors. On the 24th of June 2021, a webinar was offered by Kaspersky where the students could raise questions about the course or any other relating topic. Students were invited to share the questions before the webinar so the instructors could prepare. In the session, Ivan was present. Denis follow-up on questions via e-mail.

Question 1: How do you pick relevant samples for the Securelist blog? The stories usually have a geopolitical background. How do you differentiate between crime, ransomware, and nation-state malware samples?

Question 2: Do you work with the MICTIC framework (Malware, Infrastructure, Control Server, Telemetry, Intelligence, Cui Bono) from Dr. Timo Steffens to attribute certain actors? If not, how does Kaspersky attribute to certain nation-states?

Answer Denis: In terms of hardware platforms now I see some shift to the ARM architecture and it obviously would affect malware analysis. For how long this shift would be? Who knows, maybe the next Intel processor would be a prodigy. But in a short term, I suppose for the reversers the significance of ARM would grow up.

Also "the clouds" are upon us even here. The automated tools like the Copilot plugin for the VSCode would make the third-party code reuse even easier, so on the analyst side also should be tools to detect code similarities and share the analysis results

I think it is a very bad course. It is overestimated and overvalued. There are inconsistencies between proposed solution in videos and actual content (malware). It is practical, but practice comes first before theory; bad english from one of the instructors. I would not suggest anyone purchasing such course. Disappointing. At least they could provide the malware samples and give life access to training material at this cost.

I do think not providing the samples to students who take the course was a negative on their part (Almost any malware analysis courses I can think of, provide samples to students to further work on them outside of the course).

Malware reversing is a great topic as an anchored narrative. Without detailed knowledge of it, you might miss relevant indicators of compromise, detect false flags, or other secrets stored in it. The better you get in it, the more you will understand file formats, data structures, programming routines, etcetera. As I\u2019m very interested in the geopolitical cyber conflict between nations, I found Kaspersky delivered a virtual training course called \u201CTargeted Malware Reverse Engineering.\u201D

3a8082e126