دانلود کتاب بدافزارهای گریزان – راهنمای میدانی برای شناسایی، تحلیل و شکست تهدیدهای پیشرفته

Generally speaking, malware is any piece of software that does malicious things. Seems simple enough, right? However, there are often conflicting definitions of malware. Remcos is software sold on the open internet and described by its authors as a “remote administration tool.” However, since anyone can buy Remcos (completely legally, I might add), it’s largely used for nefarious purposes and has many of the same capabilities as a known type of malware called a remote access trojan. Another example is AsyncRAT, an open source “remote access tool” that, according to its author, is “designed to remotely monitor and control other computers through a secure, encrypted connection.” So, are Remcos and AsyncRAT malware, then? The answer largely depends on whom you ask, who’s using it, and for what purpose. Context is key. Malware analysis is the process of investigating and taking apart malicious code and software. A malware analyst’s goal is to identify and understand the behavior, functionalities, and potential impact of a malware sample and the attack surrounding it (also known as its context). Malware analysis is as much an art as a science because it often takes a great deal of creativity to fully understand a malware sample, especially if it is one of the more advanced variants, and to put that knowledge to use to detect and prevent future attacks. As we’ll discuss in Chapter 3, malware analysis can be divided into two overarching methods: static analysis and dynamic analysis.