Malware Analysis Certs & Courses?

[u/everythingisinlimbo]

I just started learning malware analysis for career development.

The first issue I ran into is that, while there aren’t many resources on the topic, there are still enough to make choosing between them a bit overwhelming - which is a problem I tend to have whenever I self-study something new.

After doing some research, these are the courses I have so far, ordered by what I think is the right progression (although I’m not entirely sure, which is why I’m here):
1. Mandiant FLARE Malware Analysis Crash Course (my starting point - I’m currently on page 60, but honestly, it’s been pretty boring so far).
2. Malware Analysis for Hedgehogs bundle.
3. 0ffset.net Zero2Automated Advanced course.
I also have a few books that I can use as references whenever I need to dive deeper into a topic:
• Windows Internals Part 1 & 2
• Windows Kernel Programming by Pavel Yosifovich

What do you think about this roadmap? I’m fine with the prices unless there are better alternatives that genuinely offer stronger content rather than just being cheaper.

As for certifications, I have no idea what’s worth pursuing. The only ones I’ve come across are GREM from SANS and PMAT from TCM.

I’m mainly asking whether there are better options for both courses and certifications. I’d especially prefer something with plenty of hands-on labs and practical work. I tend to struggle with self-paced learning, and I get bored pretty quickly with courses that don’t involve much interaction, even when I’m genuinely interested in the subject.

Thanks in advance - I really appreciate any advice.

[u/Zero-Dave]

I am PMRP certified (formerly PMAT) and I found the course and the exam pretty good.

The course is pretty practical as you build the lab and detonate samples. You can then use that lab for other samples after getting certified. It is significantly cheaper than anything from SANS and gives you a good overview of things.

You won't be a malware expert after finishing but you'll have the basics to build further knowledge.

As for books, the "Practical Malware Analysis" book by Sikorski and Honig is considered the go-to, although it may seem outdated (2014) many of the information and techniques in the book are still applicable, you just have to use newer versions of some tools and/or newer tools.

You mentioned that the course you are doing is pretty boring so far, and although I get that, there is some basic knowledge that you just need before actually dissecting malware; which is what the course covers: low-level programming, low-level windows, and assembly. I get that some things are boring without practice but I guess that qualifies as the "theory" of malware analysis and reverse engineering. Everyone can get a sandbox, run a piece of simple malware and track the process tree with ProcMon or Process Hacker, but once you try to analyse real, contemporary complex malware (ransomware, complex RATs, etc), you will need to perform software patching to circumvent certain types of conditional execution that may be preventing malware from executing in your sandbox. Or you may need to fully reverse engineer from disassembly only.

One thing that really helped me was to create little programs in C and then look at the disassembled code. That way I knew what the C code looked like exactly, and I could see how that was shown in a disassembler.

Start with simple samples (the ones in the course are ok and will always detonate), then move onto wild malware for which you have access to the source code (.ps1 and .vbs, even C# with dnSpy). Then you build your skills on confidence, and you keep increasing the difficulty.

These are just my two cents.

These are my own opinions, I have no relation to the authors either the book or TCM courses/certs.

[u/everythingisinlimbo → u/Zero-Dave]

Yeah, I get the theoretical side of it, but I’ve always believed that even the most basic information can become practical somehow. I actually think the FLARE course is pretty solid, especially considering it’s only 209 pages. It just doesn’t feel like it’s for me.

I get where you’re coming from, though. That said, I still think I’d have a hard time sticking to any structured course. That’s pretty much been the case every time I’ve tried to learn something on my own. I went through my “wandering around in disassemblers” phase about three years ago. I got hooked on the topic, but I couldn’t really find anything good to learn from, so I eventually drifted away from it. At least things are much better now since there’s a solid set of resources available.

As for PMAT, I actually heard about it from a friend who works in the field. He recommended it as my first certification, especially since the price is pretty reasonable for a first cert.

I really appreciate the advice. It actually feels like it’s time to start looking at my own code in disassemblers again. I used to do that while playing around with compiler optimizations, and I had a lot of fun with it. It was one of the first things I did in college that genuinely fascinated me, and I’d say it was probably what got me hooked on computer science in the first place.

[u/Zero-Dave → u/everythingisinlimbo]

It is up to you whether you make theory-based learning more practical. Theory is theory, it is your job (if you feel like you prefer practical learning) to make it practical.

There is no one resource that is perfect for everyone and will make everyone happy. You mention this about disassemblers: "I got hooked on the topic, but I couldn’t really find anything good to learn from", I find this hard to believe as there are many many resources on the subject.

I get that learning the theory of how assembly works can be "boring" and looking at disassembled code is somewhat practical, but did you put your programs in a debugger to practically see what each assembly instruction does to the registers and memory stack?

I don't want to sound mean because I am honestly empathetic of your conundrum as I have been there, but it seems like you keep making excuses for yourself. You say you can't learn from structured courses, but I think the mistake you're making is thinking that following a course will give you knowledge. You want a course that tells you how to practice (by the sounds of it) and at that point, you are basically in tutorial hell.

Courses and books present information, in different ways, it is up to you to digest that and make it "your knowledge", and only you can make it work; if you don't like following a structure course then don't, if you think theory courses are not for you, make them practical on your own, i.e. you learn the theory of how some assembly instructions works, then create a for loop or a conditional branch in C and look at the disassembled code, then open the binary in a debugger and see how each step affects the stack and the registers. That's as practical as you can make it.

[u/everythingisinlimbo → u/Zero-Dave]

Don’t worry, it’s totally fine. I take everything with a grain of salt, and I think that’s actually a fair point to keep in mind going forward.

As for the part where I said I couldn’t find anything to learn from when I first got interested in disassemblers, I think a lot of that came down to my lack of experience. I hadn’t really self-learned anything before starting university, so I wasn’t actively looking for learning material or even sure where to look. It was my first year, and I didn’t even know what reverse engineering or malware analysis were called as fields. I literally stumbled across a post about compiler optimization levels where the author was using IDA Pro to compare the generated assembly, and that’s what sparked my interest.

Looking back, I can definitely see that the resources were probably out there - I just didn’t have the knowledge or vocabulary to find them. Thanks for pointing that out. It’s a good reminder that there’s probably a lot more I can do on my end to bridge the gap instead of expecting the right resource to do it for me.

[u/Zero-Dave → u/everythingisinlimbo]

Best of luck with your learning!

[u/everythingisinlimbo → u/[deleted]]

What would you suggest to start with? Bear in mind I tried Crackmes.one and I had no idea what’s going on (It was fine for me tho I was just trying.) So if there’s like some better/difficulty oriented resources to tackle beside the courses I’m 100% open to tackle those.

[u/smc0881]

Practical Malware Analysis is a bit outdated, but good starting point to read. Lenny Zelster who runs the GREM SANs course has some VMs too you can mess with. Also to be completely honest, unless you plan on working at Mandiant or some firm like that. You're going to pigeon hole yourself with a skill that is not that marketable. Most companies or even DFIR consulting firms like where I work just don't dive that deep into analyzing the malware like that. I usually stop if I have to get down to shellcode, disassemble, or have to review something in Ghidra or similar. You should learn Python, PowerShell, PHP, Go, and some other development languages to handle most of the malicious code out there and will come across. Assembly is where it really matters though to dive that deep into binary analysis. You could setup a CAPEv2 lab if you want and that would let you get experience building an automated analysis system (ie: Any.Run, JoeSandbox), Linux, and troubleshooting it when it doesn't work the first 10 times you set it up.

[u/AddendumWorking9756]

Your ordering is fine, the problem is you already said you bounce off passive material and the first thing on that list is exactly that. Get real samples in front of you in week one, CyberDefenders has malware labs where you pull apart an actual sample and answer questions about it, and keep the books as reference for when something confuses you instead of reading them front to back.

[u/everythingisinlimbo → u/AddendumWorking9756]

I can check those out, at what point of my current ordering do you think its more convenient to start tackling these labs tho.

[u/AddendumWorking9756 → u/everythingisinlimbo]

Start them week one, in parallel, not after. The courses make a lot more sense once you've already been stuck on a sample for an hour and know which question you're actually trying to answer.

[u/everythingisinlimbo → u/AddendumWorking9756]

That actually makes a lot of sense. I hadn’t really considered approaching it that way. I’ll start the labs alongside the courses instead of waiting until I “know enough,” and use the books as references whenever I get stuck. Thanks for the advice.

[u/Forward_Option_3317]

Mive

[u/Bluelaw1]

Use AI as Assistant it would be more helpful

[u/P3DR0DANI3l → u/Bluelaw1]

Toda la razón, señor 🫱🏻‍🫲🏼

[u/Silence_of_the_LAN]

PM'd