FOR710: Reverse-Engineering Malware: Advanced Code Analysis

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

• CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
• CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
• BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
• 16GB of RAM or more is required.
• 200GB of free storage space or more is required.
• At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
• Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Mandatory Host Configuration And Software Requirements

• Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
• Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
• Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
• Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
• You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
• Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
• Download VMware Workstation Pro 17.5.X+ for Windows hosts or VMWare Fusion Pro 13.5.X+ for macOS hosts prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. This course requires a "Pro" version of VMware software. The "Player" versions are not sufficient.
• On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
• Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact customer service.

FOR710 training is recommended for a diverse range of individuals, including:

• Cyber security professionals who want to improve upon their intermediate-level reverse-engineering skills.
• Reverse engineers who need to improve their abilities to analyze obfuscated code, assess encryption capabilities in malware, and automate analysis tasks.

• Windows 10 VM with pre-installed malware analysis and reversing tools.
• Real-world malware samples to examine during and after class.
• Coursebooks and workbook with detailed step-by-step exercise instruction.

FOR710 is an advanced level Windows reverse-engineering course that skips over introductory and intermediate malware analysis concepts. This course assumes that students have knowledge and skills equivalent to those discussed in the SANS FOR610 Reverse-Engineering Malware course. Students should have at least six months of experience performing behavioral analysis, dynamic code analysis (i.e., using a debugger), and static code analysis (i.e., analyzing disassembled executable content). In addition, students should have some prior exposure to the Ghidra reverse engineering framework. If you're not familiar with this capability, consider watching this brief introduction by Anuj Soni.

The FOR710 course is a part of the “Digital Forensics, Malware Analysis, & Threat Intelligence” Learning Path, which aims to equip cybersecurity professionals with specialized investigative skills.

Depending on your current or desired future role, one of these courses is a great next step in your cybersecurity journey:

• FOR509 Enterprise Cloud Forensics & Incident Response
• FOR528 Ransomware and Cyber Extortion
• FOR578 Cyber Threat Intelligence
• FOR589 Cybercrime Intelligence
• FOR585 Smartphone Forensic Analysis In-Depth
• FOR518 Mac and iOS Forensic Analysis and Incident Response
• FOR577 Linux Incident Response & Analysis

Reverse-engineering malware involves analyzing malicious software to understand its functionality, behavior, and operation. The process includes disassembling the code, debugging its execution, and analyzing the malicious software’s data structures and techniques.

This process of advanced code analysis is crucial for several reasons:

• Threat intelligence: Reverse-engineering helps security professionals gain insights into new threats, attack patterns, and developing countermeasures
• Incident response: Analyzing the software helps uncover the root cause of infections, removing malware, and mitigating the impact of attacks
• Vulnerability research: Identifying software and operating system vulnerabilities exploited by malware allows security teams to bolster the organization’s defenses against future attacks
• Threat hunting: Reverse-engineering helps organizations detect and recognize malicious activity on networks
• Antivirus development: The analysis process empowers teams to create signatures and detection rules for antivirus software

While malware reverse engineering courses require specialized tools and training, the skills gained are essential for defenders across every cybersecurity discipline.

FOR710: Reverse-Engineering Malware: Advanced Code Analysis equips you with valuable skills that are highly sought-after in the cybersecurity field. You will gain in-depth knowledge of how malware functions, enabling you to:

• Identify and analyze emerging threats: Understand attack vectors and develop effective countermeasures  
• Investigate security incidents: Quickly pinpoint the root cause of breaches and assist in swift recovery  
• Contribute to vulnerability research: Discover and help patch security flaws exploited by malware  
• Enhance your technical expertise: Develop a strong foundation in systems, networking, and programming, making you a more valuable asset in any cybersecurity role  

This elite-level malware analysis training will significantly expand your career prospects and earning potential in an increasingly threat-driven world.