đŸ•šī¸
Ghoulsec Vault
Website Toolbase
  • Welcome !
  • đŸ—ƒī¸Exam Prep Notes
    • 📔CEH V13 (Master Edition)
      • Module 02: Footprinting and Reconnaissance
      • Module 03: Scanning Networks
      • Module 04: Enumeration
      • Module 05: Vulnerability Analysis
      • Module 06: System Hacking
      • Module 07: Malware Threats
      • Module 08: Sniffing
      • Module 09 : Social Engineering
      • Module 10: Denial of Service
      • Module 11: Session Hijacking
      • Module 12: Evading IDS, Firewalls , Honeypots
      • Module 13: Hacking web servers
      • Module 14: Hacking Web Applications
      • Module 15:SQL Injection
      • Module 16: Wireless Attacks
      • Module 17: Hacking Mobile Platforms
      • Module 18: IoT & OT Hacking
      • Module 19 : Cloud Computing
      • Module 20 : Cryptography
    • 📘ISC2 -Certified in Cyber Security
      • Chapter -1 Security Principals
      • Chapter -2 Disaster Recovery,Business Continuity & Incident Response
      • Chapter -3 Access Control Concepts
      • Chapter -4 Network Security
      • Chapter -5 Security Operations
    • 📗AZ - 900
      • Basics of Cloud Computing
        • Economic of Scale
        • CapEx & OpEx
        • Consumption based model
        • Cloud Deployment Models
        • Shared Responsibility Model
        • Data centers, Regions & Availability Zones & Geographyies in Azure
        • Resources & Resource Group
        • Azure Access Tools
        • Azure Service Lifecycle
        • Azure SLAs
        • Azure Cloud Adoption Framework
      • Azure Services
        • Azure Computing Services
        • Azure Networking Services
        • Azure Storage Services
        • Azure Database Service
        • Azure Marketplace
        • Big Data & Azure
        • Azure Serverless Computing
        • IoT & Azure
        • Other Azure Services
        • Azure Resource Locks & Resource Tags
        • Azure Security Services
          • Security Groups
          • Routing Tables
          • Azure Firewall
          • Azure DDOS Protection
          • Azure Identity & Access Management (Azure AD)
          • Azure RBAC
          • Azure Security Center
          • Azure Key Vault
      • Azure policies & Blueprints
      • Azure Cost Management
      • Azure Core Tenents
    • 📗SC - 900
      • Zero Trust Model
      • Shared Responsibility Model
      • Defense in Depth
      • Security Controls
      • CIA Triad
      • Encryption / Hashing / Signing
      • Microsoft Security & Compliance Principals
      • Common Identity Attacks
      • Microsoft Identity as Primary Security Perimeter
      • Modern Authentication with Azure AD
      • Azure AD Identity Types
      • Azure External Identities
      • Hybrid Identities
      • Authentication Methods & Password Protection
      • Conditional Access
      • Azure AD Roles & RBAC
      • Governance in Azure AD
      • Azure Identity Protection
      • Azure NSG, DDOS, Firewall
      • Azure Bastion & Keyvault
      • Azure Encryption
      • Azure CSPM
      • Azure Security Center
      • Azure Defender
        • Microsoft O365 Defender
        • Azure Sentinel
      • Microsoft Cloud App Security
      • Microsoft Intune
      • Microsoft Complaince Manager
      • Information Protection
      • Microsoft insider risk capabilities
    • 📔AWS Cloud Practitioner
      • Cloud Deployment
        • AWS Global Infrastructure
      • AWS Cloud Essentials
        • AWS SNS
          • AWS SQS
      • AWS Compute & Container Services
        • AWS EC2
          • Elasticity & Agility
        • AWS Serverless Computing
        • AWS Container Services
        • AWS Beanstalk
        • AWS Load Balancing
      • AWS Storage & Databases
      • AWS Networking
      • AWS Security
        • AWS Organisation
        • AWS Compliance
        • AWS DDOS
        • Additional Security Services
      • AWS Monitoring & Analytics
        • Other Analytics Services
      • AWS Pricing & Support
      • AWS Migration & Innovation
        • Migration Statergies
        • AWS Snow Family
        • AWS Transfer Family
        • Innovation on AWS
      • AWS Well Architecture Framework
      • Other AWS Services
  • 🧑‍đŸ’ģCyber Security Base
    • Ghoul's Den
    • Cheatsheets
    • SSL Handbook
      • Installing OpenSSL
      • Encrypting Web Servers using SSL
      • Compiling .pfx file using openssl
      • De-compiling .pfx file
      • Zimbra Mail Server SSL renew
      • SSL Certificates
    • â˜ī¸Cloud Security
      • Amazon Web Services (AWS)
        • AWS - IAM & Policy Management
        • AWS Organization
        • AWS - Roles (Assume Role)
        • AWS - EC2 (Elastic Computing)
        • AWS - VPC
        • AWS - Bastion Host
        • AWS Application Load Balancer
        • AWS Auto Scaling Group
        • AWS WAF
        • AWS - VPC Peering
        • AWS Transit Gateway
        • AWS NAT Gateway
        • AWS - Route 53
        • AWS Certificates Manager
        • AWS Network Load Balancer (NLB)
    • đŸ•¸ī¸Network Security
      • Firewalls
        • Sophos - Security Suite
          • Sophos Firewalls
      • VPN
        • VPNs
          • Wireguard Tunneling
          • StrongSwan Gateway VPN Server on Ubuntu
      • IP Address and IP Subnetting
      • Basic to Advance Networking Materials
    • 🧑‍đŸ’ģVAPT
      • Sample Report Templete
      • OWASP
        • OWASP Web Application Security & WebGoat
      • Web Application testing checklist
        • Client Side Penetration Testing
          • Clickjacking
          • Websockets
          • CSRF
          • XSS Filters
        • Server Side Penetration Testing
        • Advanced Web Application Pentesting
          • OAuth
          • JWT Injection
          • Server Side Templete Injection
    • â˜„ī¸GRC
      • ISMS AUDIT PLAN
      • CIS Compliance Windows
    • 🔍Forensic
      • Forensic Tools
      • EMAIL Forensics
      • File header forensics
    • Trend Micro
      • Deep Security
        • Installation & Prerequisite
          • Microsoft SQL server 2022
          • Postgres 16 Core
          • Installation
    • Practical Malware Analysis & API Threats
  • đŸ•šī¸Server are fun !
    • Securing Linux
      • Securing SSH
      • Sudoers
      • UFW (Uncomplicated FW)
      • Unattended Upgrades
      • Password Complexiety
      • Auditing Linux
      • Samba - SMB
      • NFS - Network File System
      • FTP
      • AIDE
    • Servers
      • Linux Sever
        • OpenLDAP Server Setup
          • ldap-account-manager
          • Securing OpenLDAP
          • OpenLDAP client setup
          • Checking LDAP setup
        • Users & Groups
        • Password Policy
        • File & File Permissions
        • Automatic Updates
        • Adding GUI to Ubuntu Server
        • DNS Server
        • NTP Server
      • Windows Sever
        • Deep dive into Windows Server
        • Windows server Installation
        • Disable IPv6
        • Disable Server Manager on startup
        • Promoting OS to AD server
        • AD DNS
        • AD DHCP
        • AD Activation
        • AD Users & Groups
        • AD FileServer
        • Adding Users into AD
        • Bulk Importing users into Domain
        • Windows AD Resources
        • Group Policy Editor
          • Creating First Policy
          • Restricting CMD & Powershell
          • Password Policies
          • Audit Policies
          • Log Retention Policy
          • Windows Defender Firewall
          • Patch Management & Window Updates
        • Setting Up local accounts for windows hosts
    • Hacking Systems
      • Linux Systems
        • Battery Charge Threshold (Linux)
        • Metasploitable OS Complete Solved
      • Tricking Windows
        • Bitlocker & Time based policy bypass
    • Monitoring HeartBeats
    • RAID Technology
    • Managing Partitions
      • Parted
      • Fdisk
      • LVM
        • Re-claiming unused disk space
        • Adding physical volume into VG
        • Removing physical volume from VG
      • SWAP Memory
    • Virtualization
      • Proxmox
        • Proxmox VE Installation
        • Default Storage Expansion
        • Proxmox Network Link Aggegration
        • NAT Interface Configuration
        • Importing disk into proxmox
        • Creating an LVM Thin Pool
        • Proxmox IAM
  • đŸ™â€â™‚ī¸Dan the AI Expert
    • Ollama Ollama ...
      • Ollama
        • Ollama models
        • Open Web UI & Ollama Integration
    • Microsoft Presentation using AI
  • đŸ›Ąī¸Security Operations
    • Wazuh - Open Source XDR. Open Source SIEM.
      • Components
      • Deployment Methods
      • Installation
        • Single Node Installation
          • Wazuh Indexer Installation
          • Wazuh Server Installation
          • Wazuh Dashboard Installation
          • Single node deployment with Script
        • Managing multiple Wazuh clusters with Cross-Cluster Search
          • Cluster Configuration
          • Set up Cross-Cluster Search
        • Upgrading Wazuh Central Components
        • Uninstalling Wazuh
      • Custom Decoder & Rules
        • Pfsense Decoders
        • Pfsense Rules
      • Security Operations Center Tools (Wazuh)
    • IRIS-DFIR / Case Management
    • Graylog & ElasticSearch
    • Zabbix NMS
      • Zabbix Installation
      • Zabbix Database Management
        • Zabbix Database backup
        • Zabbix Database restore
        • MySQL Replication (M-M)
        • MySQL Replication (M-W)
      • Zabbix Geomap Setup
      • Adding Hosts into Zabbix
      • Zabbix Hostgroups
      • Auto Registration Hosts Zabbix
      • Zabbix Globalscrips
      • Zabbix HA Cluster
      • Zabbix Proxy
      • Zabbix Notifications
      • Zabbix Maintainance
      • Zabbix User Management & Authentication
      • Zabbix Housekeeping
      • Scheduled Reporting
      • Service Monitoring using Zabbix
  • Git the master!!
    • Configuring git
    • Git Branches
    • Undoing changes
    • Git - Cheat sheet
    • My first git...
Powered by GitBook
On this page
  • Lab 1: Gain Access to the Target System using Trojans
  • Task 1: Gain Control over a Victim Machine using the njRAT RAT Trojan
  • Lab 2: Infect the Target System using a Virus
  • Task 1: Create a Virus using the JPS Virus Maker Tool and Infect the Target System
  • Lab 3: Perform Static Malware Analysis
  • Task 1: Perform Malware Scanning using Hybrid Analysis
  • Task 2: Analyze ELF Executable File using Detect It Easy (DIE)
  • Task 3: Perform Malware Disassembly using IDA and OllyDbg
  • Lab 4: Perform Dynamic Malware Analysis
  • Task 1: Perform Port Monitoring using TCPView and CurrPorts
  • Task 2: Perform Process Monitoring using Process Monitor
  1. Exam Prep Notes
  2. CEH V13 (Master Edition)

Module 07: Malware Threats

Lab Tasks :

  1. Gain access to the target system using Trojans

    • Gain control over a victim machine using the njRAT RAT Trojan

  2. Infect the target system using a virus

    • Create a virus using the JPS Virus Maker Tool and infect the target system

  3. Perform static malware analysis

    • Perform malware scanning using Hybrid Analysis

    • Analyze ELF executable file using Detect It Easy (DIE)

    • Perform malware disassembly using IDA and OllyDbg

  4. Perform dynamic malware analysis

    • Perform port monitoring using TCPView and CurrPorts

    • Perform process monitoring using Process Monitor

Lab 1: Gain Access to the Target System using Trojans

Task 1: Gain Control over a Victim Machine using the njRAT RAT Trojan

## Tools used in this section :
1. njRAT : RAT Trojan

Lab 2: Infect the Target System using a Virus

Task 1: Create a Virus using the JPS Virus Maker Tool and Infect the Target System

## Tools used in this section :
1. JPS Virus Maker 4.0

Lab 3: Perform Static Malware Analysis

Task 1: Perform Malware Scanning using Hybrid Analysis

Task 2: Analyze ELF Executable File using Detect It Easy (DIE)

## Tools used in this section :
1.  Die.exe
2.  Macro_Pack
3.  ASPack
4.  VMprotect

Task 3: Perform Malware Disassembly using IDA and OllyDbg

## Tools used in this section :
1. IDA Pro
2. Ollydbg

Lab 4: Perform Dynamic Malware Analysis

Task 1: Perform Port Monitoring using TCPView and CurrPorts

## Tools used in this section : 
1.  TCP View
2.  CurrPorts
3.  TCP Port/Telnet Monitoring   : https://www.dotcom-monitor.com
4.  PRTG Network Monitor         : https://www.paessler.com
5.  SolarWinds Open Port Scanner : https://www.solarwinds.com

Task 2: Perform Process Monitoring using Process Monitor

## Tools used in this section :
1. ProcessMonitor : Procmon.exe

PreviousModule 06: System HackingNextModule 08: Sniffing

Last updated 5 months ago

Hybrid Analysis :

đŸ—ƒī¸
📔
https://www.hybrid-analysis.com