CSC 471 Modern Malware Analysis

Final project Guidline:

About the Final Report:

• Each team needs to submit one detailed malware analysis report (in PDF format) on D2L. The team leader needs to submit the report using his/her student account to D2L, in the first page of your group report, please write down how your team divides the tasks for each member.
• In your report, please use both text and figure (e.g., screenshot) to show what you've done. Do NOT copy or reuse other groups/student's screenshots.
• Malware analysis report is a document that provides an in-depth breakdown of the functionality and risk of a new or evolving cyber threat. Your malware analysis report should include the following information:
• Introduction -- give a brief introduction of the malware
• Findings -- describes what the malware is designed to do by using the following two methods:
• Use Volatility to analyze the malware memory dump and report how Volatility could be used to find relevant artifacts of the activity within memory (e.g., find all API Hooks of Zeus).
• Use the leaked malware source code to justify such activity (e.g., identify which function/line of code that does the API Hooks). (Note that this part is very important, your group needs to pinpoint the functions/line of codes for each malware activity that you find in the memory dump).
• Summary -- Summary of your work and give some best practices for preventing infections and recovering from them.

Report Grading Rubric:

• Technical Content (50%)
• Find an adequate amount of malware activities/behaviors from the memory dump and justify it using the leaked source code
• Appropriate level of detail and thoroughness of documentation
• Organization (15%)
• Clearly identified purpose and approach
• Content is clearly organized and supports the objective
• Presentation (15%)
• Easy to read
• Layout/Visuals (20%)
• Consistent presentation of graphics

Presentation Rubic:

• 6% Slides --> 12+ pages, all content throughout the presentation is accurate. There are no factual errors.
• 6% Presentation --> 15 mins, technical terms are well-defined, and the presentation demonstrates substance and depth.
• 2% Q&A Session --> 5 mins, demonstrates full knowledge of the topic.
• 1% --> prepare and ask questions for other groups.

Tutorials and Supporting Materials

• How to connect to BadgerCTF
• How to write a lab report
• Download MobaXterm (Windows)
• How to use VIM
• How to use Nano
• Overview of IA-32 assembly
• x86 Assembly Language Reference Manual
• A Guide to Programming Intel IA32 PC Architecture programming
• RMS's gdb Tutorial
• GEF - GDB Enhanced Features
• Volatility