WEBVTT 00:01.870 --> 00:04.450 Hello and welcome everyone. 00:04.450 --> 00:05.560 My name is Christina. 00:06.010 --> 00:10.250 I am a trainer and coach with a strong background in software security. 00:10.510 --> 00:16.150 For the past 10 years I've been working in banking in the street where security is a topic on a daily 00:16.150 --> 00:17.190 basis. 00:17.230 --> 00:19.830 I am very happy that you decided to join this course. 00:22.600 --> 00:28.090 The aim of this course is to provide a practical approach to analyzing ransomware somewhere working 00:28.090 --> 00:35.560 with real war samples of increasing difficulty we will deep dive into identifying the encryption techniques 00:36.130 --> 00:42.910 navigate through various evasion tricks used by malware writers have fun discovering flaws in the logic 00:43.070 --> 00:49.840 for the implementation and finally working out automated ways to recover the affected files. 00:49.930 --> 00:56.610 The course begins by quickly describing the evolution of this threat across the years and multiple platforms. 00:56.770 --> 01:00.680 Then quickly dry dives in analyzing actual samples. 01:00.940 --> 01:08.590 Since Windows is by far the most popular target platform we focus on this operating system neither programming 01:08.620 --> 01:14.950 experience nor assembly language knowledge are required to benefit from the course although they would 01:14.950 --> 01:16.130 be helpful. 01:16.180 --> 01:22.620 The concepts will be explained in a clear and concise manner and additional resources recommended. 01:22.630 --> 01:28.210 The topics have been chosen to provide the maximum practical benefit for the participants like Janet 01:28.230 --> 01:33.790 an idea about core programming concepts would be very beneficial when we start writing the creators 01:34.450 --> 01:35.420 Python. 01:35.440 --> 01:40.700 A high level language is used whenever possible to move the focus away from the code. 01:40.890 --> 01:46.350 People understanding that the creation children logic to get the most out of discourse when he commands 01:46.370 --> 01:49.510 to exercise all the steps described within the lectures. 01:49.540 --> 01:55.480 Then whenever a concept or idea is not fully explained or clearly understood by the rich old with questions 01:55.510 --> 02:00.790 or consult online for resources why they discourse. 02:01.190 --> 02:07.490 Mostly because you like a practical malware analysis class focused on a real threat around someone somewhat 02:07.910 --> 02:11.650 also because you're curious how Harron somewhere already forced. 02:11.680 --> 02:17.460 And what magic do security companies use sometimes pretty covert encrypted files. 02:17.670 --> 02:23.660 Discourse intention used to be useful and interesting to everybody involved in information security 02:23.690 --> 02:30.170 and malware analyses from students to security testers and forensic investigators. 02:30.170 --> 02:34.900 If you wish to further develop your skills and understand how reverse engineering works. 02:35.030 --> 02:38.080 Many responses will be suggested along the way. 02:39.560 --> 02:44.310 The course will explain all the features of the words used for analysis. 02:44.430 --> 02:50.780 Bloggers these assemblers hex editors and students will be able to practice in parallel with the lectures 02:51.500 --> 02:58.850 a lot of the concepts and analysis strategies presented here applied to analyzing malware in general 02:59.510 --> 03:04.440 once you have completed these training course you will understand how ransomware works. 03:04.670 --> 03:11.270 You will be capable of locating and reverse engineering the encryption routines and when possible even 03:11.270 --> 03:18.980 create descriptors to recover your data working or working files not included or allowing you to follow 03:18.980 --> 03:20.210 along with the author. 03:20.230 --> 03:21.350 While the lessons 03:25.060 --> 03:32.230 this course is for anyone interested in information security internal and malware analysis in particular 03:32.410 --> 03:42.760 including what not only security testers malware analysts forensic investigators sees them on many straight 03:42.770 --> 03:45.520 hours Information Security students 03:49.450 --> 03:52.780 this course is not an introduction to Marwood. 03:52.920 --> 03:56.460 It only focuses on the soft topic of around somewhere. 03:57.020 --> 03:59.390 Although safety issues are presented. 03:59.460 --> 04:04.530 This is not a tutorial on how to configure a malware analysis virtual environment. 04:04.980 --> 04:07.410 Although generally information is presented. 04:07.410 --> 04:14.410 This is not an elaborate high level description of somewhat solutions for thinking two or three bars. 04:14.420 --> 04:20.690 The encryption process and recovering files are presented but this is not the course about how to prevent 04:20.690 --> 04:27.650 around somewhat in the first place basic familiarity with reverse engineering concepts would be very 04:27.650 --> 04:34.390 useful although not strictly strictly necessary because this is not an introduction to reverse engineering. 04:35.680 --> 04:40.510 Although it should be obvious this is not a video on how to write better than somewhat 04:43.930 --> 04:52.000 the lectures videos and other resources will be provided or will provide you with relevant information 04:52.000 --> 04:55.180 about current malware analysis tricks. 04:55.390 --> 04:59.640 You will learn how to use these assemblers and other security tools. 04:59.860 --> 05:05.260 You will learn to identify flaws in the around somewhat cold or encryption and you will practice on 05:05.320 --> 05:11.450 progressively difficult samples which use different concepts each you will get the practical assessment 05:11.470 --> 05:14.200 and relevant quizzes for each section. 05:14.230 --> 05:20.830 Source code for all the description will be also provided a clear list of recommended resources to continue 05:20.830 --> 05:21.410 your study. 05:27.720 --> 05:34.820 At the minimum you will have basic programming knowledge a computer that can run on Windows virtual 05:34.820 --> 05:41.510 machine learning interesting disassembling things and understanding how they wore patience and perseverance 05:41.540 --> 05:42.380 to try hard. 05:45.300 --> 05:46.680 Thank you. 05:46.680 --> 05:48.150 And seeing lecture 1.