Reverse Engineering Malware Part III

Reverse engineering is one of the most well-paid skills in Cybersecurity. If you want to know how to do it, then this is the right course for you. This is Part III.

Enroll now

Reverse Engineering Malware III

This intensive 3-day course equips cybersecurity professionals with the practical skills to dissect Windows malware and understand the internals of executable binaries. Through hands-on labs and real-world case studies, participants will deconstruct the Portable Executable (PE) format, analyze the internal mechanisms of the Windows operating system, and explore how modern ransomware operates at a binary level.

Using live samples of Cactus and LockBit 3.0, students will trace malware behavior, unravel execution flows, and extract TTPs from packed and obfuscated binaries. The course bridges theory and practice by exploring how system APIs, memory management, and persistence techniques are abused.

Participants will work with professional-grade tooling, including IDA Pro, Ghidra, x64dbg, PE-Bear, Detect It Easy, and much more. Emphasis is placed on unpacking techniques, API resolution, string decryption, and code flow recovery. By the end of the course, students will not only understand how malware works but also how the OS responds internally, forming a deep, OS-level perspective essential for analysts, threat hunters, and reverse engineers alike.

Course curriculum

1. 01 Introduction To REM 3
2. 02 Introduction To Pe Anatomy
3. 03 Dos Header
4. 04 File Header
5. 05 Optional Header
6. 06 Section Header
7. 07 Imports
8. 08 Exception Baserelocate Tls
9. 09 Pe Anatomy Recap
1. 10 Cactus General Overview
2. 11 Cactus First Look Into Die
3. 12 Cactus Entropy Levels Packed Version
4. 13 Cactus Strings Openssl Packed Version
5. 14 Cactus Strings Chacha20 Packed Version
6. 15 Cactus Strings Http Packed Version
7. 16 Cactus Imports Packed Version
8. 17 Cactus Unpacking And First Look
9. 18 Cactus File System Implications
10. 19 Cactus Chacha20 Implementation
11. 20 Cactus Ghidra Session
1. 21 Lockbit3 Introduction
2. 22 Lockbit3 Detonation
3. 23 Lockbit3 Basic Triage