RED TEAM Operator: Malware Development Intermediate Course by SEKTOR7 Institute
Buy for $199

RED TEAM Operator: Malware Development Intermediate Course

Buy for $199

Launches on October 24th, 2020

Welcome to Malware Development Intermediate course!

In our previous Essentials course we discussed basic steps to create a custom dropper.

This course builds on what you have learned so far by extending your development capabilities with:
  • playing with Process Environment Blocks and implementing our own function address resolution
  • more advanced code injection techniques
  • understanding how reflective binaries work and building custom reflective DLLs, either with source or binary only
  • in-memory hooking, capturing execution flow to block, monitor or evade functions of interest
  • grasping 32- and 64-bit processing and performing migrations between x86 and x64 processes
  • discussing inter process communication and how to control execution of multiple payloads
The course ends with a combined project, where you will create a custom dropper implementing discussed techniques.

You will receive a virtual machine with complete environment for developing and testing your software, and a set of source code templates which will allow you to focus on understanding the essential mechanisms instead of less important technical aspects of implementation.

COURSE IN A NUTSHELL

You Will Learn

  • What is PEB and how function address resolution works
  • What are other code injection techniques
  • How to build custom reflective binary
  • How to hook APIs in memory
  • How to migrate between 32- and 64-bit processes
  • How to use IPC to control your payloads

Target Audience

  • Ethical Hackers
  • Penetration Testers
  • Blue Teamers
  • Threat Hunters
  • All security engineers/professionals wanting to learn advanced offensive tactics

Requirements

  • Recommended: taking Malware Development Essentials course
  • Understanding of operating system architecture
  • Some experience with Windows OS
  • Computer with min. 4 GB of RAM + 30 GB of free disk space
  • VirtualBox 6.0+ installed
  • Strong will to learn and having fun

What's included?

Text Icon 22 text files

Contents

Intro and Setup
Setup
Get access
PE madness
Process Environment Block parsing
Get access
GetProcAddress implementation
Get access
GetModuleHandle implementation
Get access
PE without Import Table
Get access
Code Injection
Classic Injection Variations
Get access
Thread Context
Get access
Section Maps
Get access
Asynchronous Procedure Calls
Get access
Early Bird
Get access
Reflective DLLs
Reflective Injection Explained
Get access
Binary Transformation
Get access
Source Implementation
Get access
x86 vs x64
Jumping between 32-bit and 64-bit
Get access
WoW64 and Heaven's Gate
Get access
32-bit -> 64-bit Migration
Get access
Hooking
Detours
Get access
IAT hooking
Get access
Call Patching
Get access
Payload Control via IPC/Sync
Mutants and ...
Get access
Combined Project
Custom binary
Get access
Summary
Closing Info
Get access

Instructor: reenz0h

Chief Research Officer at SEKTOR7. In the industry for over 20 years. Worked in global Red Team for almost a decade. Simulated threat actors targeting IT infrastructure across various industries (financial, technology, industrial, energy, aviation) around the world. Speaker at HackCon, PWNing, WTH@ck, Sec-T, T2, DeepSec. Gave guest lectures at several military and civil academies and universities.

Founder of x33fcon security conference
and SEKTOR7 offensive research company

FAQs

How long is the course?

All videos will be about 3-4h long.

What language is used in the course?

All videos, text and materials are in English.

Is it on-line course only?

The course is composed of 2 types of materials. Videos, which are available on-line only, and virtual machine with source code templates, which can be downloaded and stored on your computer, so you can access it later off-line.

How long is the course available after purchase?

After you purchase the course, you have access to all the videos and materials without any time limit. You can learn whenever you want, the content will always await for you.
Moreover, any updates to the course materials (ie. new modules, new videos, new files, etc.) will also be available for anyone who purchased the course without any extra charge.

Do I have to be an expert in C language or Intel assembly?

No. Although some level of experience in C programming and Intel assembly reading is required, you don't have to be an expert in this field. Basic knowledge about the syntax, data structures and function calling convention is enough during the course.
For refresher check these resources: 

I don't have Paypal account. What can I do?

We accept payments via Paypal and credit/debit cards. To use the latter, choose Paypal payment. You will get redirected to Paypal website where you can choose between PP and credit/debit card payment.

How can I get an invoice?

You can get an invoice after you purchase the course.
After logging into your account, first go to Account and fill out Your address (ie. company name, street, etc,). Then go to Billing and just download the invoice.

How to change VAT rate?

When you are registering in the course, you can choose VAT rate appropriate for your country (if you are from EU). After you supply your email, the system will present you a price with suggested VAT rate, and, if a tax rate is inappropriate or you do not qualify for VAT because of your tax residence, adjust the rate by clicking on update and chose your country of residence.

Can I get a Certificate of Completion?

Yes, Certificate of Completion will be provided on request (send an email to training+CoC @ sektor7.net). 

Legal Disclaimer

All the materials are for educational and research purposes only.
 
Do not attempt to violate the law with anything contained in materials produced by SEKTOR7. Neither administration of this server, the authors of this material, or anyone else affiliated in any way, is going to accept responsibility for your actions.

By using institute.sektor7.net and its contents, you accept that you will only lawfully use it in a test lab – with devices that you own or are allowed to conduct penetration tests for your customers and clients.

Do not abuse this material. Be responsible.