Free Online Information Technology Malware Analysis Course

Malware, also known as malicious software, is a growing threat to individuals and organizations alike. With the increasing sophistication of cyberattacks, there is a greater need for professionals who possess the knowledge and skills to detect, prevent and mitigate malware attacks. The online learning industry has responded by offering a variety of courses that cover different aspects of malware, from its types and behaviors to the tactics used by attackers. This article aims to provide an overview of the best malware courses available online, and to help you decide which one is the best fit for your needs.

Here’s a look at the Best Malware Courses and Certifications Online and what they have to offer for you!

Free Online Information Technology Malware Analysis Course

1. Malware Analysis & Incident Response for IT Technicians by John Courtenay (Udemy) (Our Best Pick)

Course Title: Malware Analysis & Incident Response for IT TechniciansThis course is designed to teach IT technicians the best practices to prevent and respond to IT security incidents, specifically focusing on ransomware attacks on their organisation’s network. The course covers various topics, including malware analysis, incident response, incident prevention, and escalation procedures.The first topic covered in the course is the key differences between malware analysis and incident response. It will provide an understanding of the different methods and tools used to detect and analyse malware.The second topic focuses on known malware, online file analysis, and tools that can be used to analyse running processes. This section is designed to help learners recognise malware and understand the tools available to analyse it.The third topic, unknown malware, covers how to recognise suspicious files, using heuristic activity detection and vulnerability analysis. This section is crucial as it helps IT technicians to detect malware that is not known or recognised.The fourth topic is incident prevention, which includes securing removable storage and an explanation of email filtering and analysis tools. This section is designed to help IT technicians prevent incidents from occurring.The final topic is incident response, escalation procedures, and service priorities. This section covers the steps to take when an incident occurs, the escalation procedures, and the service priorities.It is important to note that each organisation will have its unique requirements regarding incident response and prevention. Before making any critical changes to an organisation’s network, it is essential to follow the company’s policies to ensure that incidents are resolved smoothly, with the least amount of downtime and inconvenience to end-users.Overall, this course provides IT technicians with a comprehensive understanding of malware analysis and incident response, promoting incident prevention and response knowledge, skills, and readiness.

2. Reverse Engineering & Malware Analysis of .NET & Java by Paul Chin (Udemy)

The Reverse Engineering & Malware Analysis of .NET & Java course is aimed at beginners who wish to gain fundamental knowledge on analyzing malicious .NET and Java executable files. Malware authors create cross-platform malware using .NET and Java, which poses a great threat to computer systems. The course covers the basics of malware analysis and introduces the tools and techniques used to reverse engineer and analyze .NET and Java binaries. The course provides practical walk-throughs and all necessary tools for malware analysis will be provided. The emphasis is on practicals and lab exercises.

The course covers how to check and analyze malicious .NET and Java executables for signs of malicious artifacts and indicators of compromise. The course is designed for those who are new to this field and will take students from a beginner level to a proficient level in analyzing malicious .NET and Java binaries. Flare-VM and Windows virtual machine will be used for lab exercises, which contains all the necessary tools for malware analysis.

The course content is divided into multiple sections, including an introduction, principles of .NET and Java malware analysis, installation of ILDASM and ILASM, principles of .NET analysis, installation and usage of dnSpy, lab demos on reverse engineering .NET executables, lab exercises for analyzing .NET malware and spyware Trojan, principles of Java bytecodes, reverse engineering and malware analysis of Java binaries using bytecode viewer, and a lab exercise for analyzing a Java RAT. Resources for further study are also provided.

By the end of the course, students will have the fundamentals of malware analysis of .NET and Java under their belt and will be able to further their studies in this field. The knowledge and skills gained can also be used to protect oneself from these attacks. The course covers all essential theory but focuses more on practicals and lab exercises. The course instructor is Paul Chin.

3. Reverse Engineering & Malware Analysis – Intermediate Level by Paul Chin (Udemy)

The Reverse Engineering & Malware Analysis – Intermediate Level Course offers an opportunity for individuals with basic knowledge in reverse engineering and malware analysis to advance their skills. The course places emphasis on unpacking malware, which is often packed to evade analysis. The curriculum is highly practical and includes walk-throughs that learners can replicate and follow along. Throughout the course, learners will be introduced to and familiarized with the necessary tools, including API Hooking and Memory Analysis and Tracing.

Notably, learners will work with Oracle Virtual Machine installed with Flare-VM, which is free. The course covers topics such as Dynamic and Static Analysis, Assembly Language Refresher and Malicious APIs, API Hooking, Process Hijacking, Dumping Memory, and more.

This course is designed for students who have already completed a basic level malware analysis course, hackers looking for additional tools and techniques to reverse software, and reverse engineers who want to venture into malware analysis. The prerequisites for the course include some basics in malware analysis or software reverse engineering, and a Windows PC with Virtual Machine and Flare-VM Installed.

The course comprises an introduction, Types of Malware and Malware Analysis Terminologies, Lab: Analysis of .NET Trojan Spyware (Info-Stealers), Assembly Language Refresher and Malicious APIs, API Hooking, Process Hijacking and Dumping Memory, and a series of labs. The labs include Unpacking Emotet Trojan, Unpacking Hancitor Trojan, Unpacking Vmprotect Trojan, Unpacking Trickbot Trojan, Unpacking Dridex Trojan, Unpacking Ramnit Trojan, Unpacking Remcos Trojan with xdbg and dnSpy, and Unpacking Zloader Trojan. The course also includes Resources For Further Study.

Overall, the Reverse Engineering & Malware Analysis – Intermediate Level Course is a practical course that enables learners to advance their skills in malware analysis.

4. Expert Malware Analysis and Reverse Engineering by Abhinav singh (Udemy)

The Expert Malware Analysis and Reverse Engineering Course, taught by Abhinav Singh, is a beginner to expert series that covers the fundamental concepts of malware analysis and reverse engineering. This course is designed to help information security professionals understand the complicated steps of static and dynamic malware analysis. Upon completion, students will be equipped with the necessary skills to conduct malware incident response investigations and analyze advanced persistent threats.

The course offers over 4 hours of content that focuses on the key skills required for effective analysis of web threats. Additionally, the course is fully interactive and community-driven. Students will learn about static and dynamic malware analysis and its various steps, file format analysis of standard formats like PDF, Flash, Word, Excel, etc., and the cyber kill chain and how it applies to malware attack life cycle.

Students will also gain a deep understanding of relevant tools that can help in uncovering complex malware traits, the basics of Reverse Engineering, and how it can be used to analyze advanced malware behavior. The course also covers incidence response and report generation skills for information security professionals.

The course is broken down into four sections: Course Introduction & Overview of Cyber Kill chain, Getting started with analyzing malicious Files, Network-Based Analysis, and Forensics, and Portable Executable File Analysis & Reverse Engineering. Students can post their queries and doubts in the course, and the instructor will be available to help them in their learning curve.

5. Malware Analysis Of Malicious Documents by Paul Chin (Udemy)

The Malware Analysis of Malicious Documents course is designed for beginners and focuses on analyzing malicious PDF and Microsoft Office documents using Remnux and Windows virtual machines. The course highlights that documents are a popular vector for malware attacks due to their widespread use. The course aims to teach learners how to check and analyze malicious documents for signs of malicious artifacts and indicators of compromise.

The course is suitable for those who are new to the field of malware analysis. The course content consists of practical walk-throughs and includes all necessary tools required for malware analysis. By the end of the course, learners will have fundamental knowledge and skills in malware analysis of documents.

The course makes use of Remnux, a Debian-based Linux distribution, which contains all the necessary tools for malware analysis. Background knowledge of Linux would be helpful but is not mandatory. Additionally, the course will cover the use of document debuggers in a Windows virtual machine.

The emphasis of the course is on practicals and lab exercises, and essential theory is kept to a minimum. The course is suitable for those who do not intend to take up malware analysis as a career but wish to learn how to check documents for dangers and protect themselves from these attacks.

The course content includes an introduction, installing the tools, malware analysis process, intro to static analysis, analyzing PDF documents, performing JavaScript analysis, lab: PDF analysis, analyzing Office documents, performing VBA script analysis, using debuggers in document analysis, lab: analyzing an Office document, and resources for further study.

Enrollment is open for the Malware Analysis of Malicious Documents course. By the end of the course, learners will have a basic understanding of malware analysis of documents using practical walk-throughs and real-world scenarios.

6. Practical Hacking: Undetectable Malware by Arsalan Saleem, Secure Techware (Udemy)

The Practical Hacking: Undetectable Malware course, instructed by Arsalan Saleem of Secure Techware, aims to teach ethical hacking by providing students with the knowledge to bypass antiviruses and firewalls and defend against them. The course consists of creating undetectable malware and executing attacks on fully-patched systems to gain access. Additionally, students learn how to bind payloads with various files and hack systems outside of their networks. The course also delves into the fourth phase of hacking, maintaining access, and shows how to create malware that can bypass any antivirus and firewall.

The course is divided into several sections, commencing with an introduction. The course then covers a MetaSploit crash course and an introduction to the Veil 3.0 Framework. Students learn to create payloads with Veil 3.0 and about payload binding methods. Launching an attack, post-attack and persistence connection, and how to defend against malware attacks are also covered. The course includes additional materials for students to use.

Upon completing the Practical Hacking: Undetectable Malware course, students should be able to create malware that can bypass any antivirus and firewall. The course aims to equip students with knowledge of how to defend against these types of malware.

7. Ethical Hacking Foundations: Malware Development in Windows by Reenzo Black (Udemy)

The course titled, Ethical Hacking Foundations: Malware Development in Windows, aims to equip individuals with the knowledge and skills to develop custom Windows malware from scratch. The course targets pen testers with experience in Metasploit or Empire frameworks, ethical hackers who seek to understand offensive tools, and blue teamers or threat hunters who need to understand malware workings.

The course focuses on the development of custom malware for the latest Microsoft Windows 10 operating system. Students will learn how to build droppers for any payload, inject shellcodes into remote processes, create trojan horses, and bypass Windows Defender AV.

The course provides a virtual machine with a complete environment for developing and testing software, and source code templates that enable students to focus on understanding essential mechanisms instead of technical implementation aspects.

The course is divided into sections that cover Introduction, Portable Executable, Droppers, Obfuscation and Hiding, Backdoors and Trojans, Code Injection, Making Programs Invisible, and Summary.

8. Reverse Engineering Essentials by Cristina Gheorghisan (Udemy)

The Reverse Engineering Essentials course, instructed by Cristina Gheorghisan, provides an overview of the fundamental techniques and tools required for reverse engineering and malware analysis in a Windows environment. The course aims to cater to both novices and advanced analysts, providing a complete picture of reverse engineering. The course emphasizes understanding the purpose and objective of a task rather than detailing how to perform it. No prior programming or assembly language knowledge is required to benefit from the course, although some familiarity with these concepts may be helpful when looking at identifying encryption algorithms and bypassing anti-virtualization checks. The course will also provide clear explanations and supplementary resources.

To participate in the course, students require a Windows virtual machine and a willingness to learn. The course materials and all the tools used in the course are available online for free. The analyses are demonstrated on a Windows 8.1 virtual machine. While a programming background may be advantageous, the primary focus of the course is to comprehend the methods and apparatuses, along with their useful features. The course includes source code in C or Python when necessary.

To make the most of this course, the instructors recommend that students complete all the exercises and assignments that follow the lectures. If any concept or idea is not fully understood, students are encouraged to reach out with questions in the Q&A section or consult other resources online.

The course is divided into four sections: Introduction, Building a virtual environment, Analysis Tools, and Next Steps.

9. Hands-on Malware Analysis (Windows 10/11 compatible) by Sanru online Academy (Udemy)

The Hands-on Malware Analysis course offered by Sanru online Academy is designed to help students learn Malware Analysis by coding various types of malware including ransomware, keyloggers, injectors, malicious DLLs, and more. The course promises to take students through the process of Static to Dynamic Analysis, enabling them to catch, examine, and analyze malware samples in their system and network. The labs in the course are compatible with Windows 11 and the course is 100% interactive. In addition, the course is regularly updated and includes full access to source code along with a promise to answer all questions from students. The course is meant to provide students with everything they need to start their career as a malware analyst in one of the highest paying sectors of the cybersecurity industry. The course is designed to be easy to follow and provides ample resources to help students learn. The course is designed based on the premise that one cannot analyze something they do not understand how it works. Therefore, the course provides full malware source code with proof of concept and walks students through malware samples line by line. The course also teaches students stealth techniques, obfuscation, armoring, and persistence using malware samples. The course is designed by experienced malware analysts, cybersecurity researchers, and academics. It includes various resources such as Rams1 (a ransomware malware sample), DecryptRams1 (software to decrypt files encrypted by Rams1), Ransomware Help (document to help if infected), TotalAware2 (a keylogger able to steal Facebook credentials), Injector7 (injects malicious code into a legitimate Windows process), Dll4 (sample malware coded into a DLL), Dll8 (shows how to use export function in a DLL), Practices (lab exercises guide), Lab Requirements and quick guide (document to help set up a safe lab for malware analysis), Web Resources (document with web pages used in the course), and CriticalPatchWin1.

10. Fundamentals of Building a Remote Access Tool (RAT1) in C# by Paul Chin (Udemy)

The Fundamentals of Building a Remote Access Tool (RAT1) in C# course is designed for individuals who wish to learn basic C# programming, networking, and client-server technology by writing a Remote Access Trojan from scratch. Remote Access Tools, also known as RATs, are used to remotely control another PC over the Internet or the Local Area Network. This course offers an easy and simple step-by-step approach to building such a tool.

While there are existing open source RATs on the Internet, they are often complex and difficult to understand. This course is created to fill that gap and assumes no prior knowledge of networking or coding. The emphasis of this course is to teach the fundamentals of networking, client-server communication, multi-tasking, control and management of server processes, command creation and handling, and more.

Throughout the course, learners will gain insight into what it is like to write a remote access tool from scratch from a Malware Developers’ perspective. All source code is taken from the classic RATs development book entitled How to Write Your Own Remote Access Tools in C#, authored by the course instructor in 2007 and updated for 2021.

The course features practical, hands-on exercises and walk-throughs that learners can replicate and follow along with. By the end of the course, learners will have the basic knowledge to further their studies in RAT development by looking at existing open source RATs on the Internet.

The course is suitable for individuals interested in reverse engineering, malware analysis, or penetration testing as a career path. It is also helpful for security professionals who wish to gain insider knowledge and skills in RAT development, which can be used to better understand how to reverse engineer malware.

Free tools provided by Microsoft Visual Studio 2019/2022 Community Edition will be used throughout the course. Additionally, the course instructor will teach how to enable the Telnet windows feature in Windows 10.