Path 17: Malware & Reverse Engineering — KashSec Academy

A deep dive into reverse engineering and malware analysis — PE internals, Ghidra disassembly, dynamic analysis, unpacking, and writing YARA detection rules. 17 free lessons, advanced level, starting with "Reverse Engineering Fundamentals"

Level: Advanced · 17 lessons · Free, no account needed.

Lessons in this path

  1. Reverse Engineering Fundamentals — What RE is, assembly basics, and the core toolset.
  2. x86 vs. ARM Architectures — Why architecture matters before you read a single instruction.
  3. Malware Families Deep Dive — Ransomware crypto, rootkits, worms, and botnet C2, mechanically explained.
  4. C2 Frameworks and Infrastructure — Beaconing, DGAs, and Cobalt Strike/Sliver/Mythic.
  5. Static Analysis Deep Dive — PE format internals, imports, and entropy analysis.
  6. ELF Format & Linux Malware — Cryptominers, fileless techniques, and cloud-native malware.
  7. Disassembly with Ghidra — Hands-on: navigating, decompiling, and renaming your way through a real binary.
  8. Ghidra Scripting Basics — Automating repetitive analysis with the scripting API.
  9. Dynamic Analysis & Sandboxing — Automated sandboxes, ProcMon, and combining static + dynamic workflow.
  10. API Hooking & Monitoring — How dynamic analysis tools actually capture behavior.
  11. Unpacking & Obfuscation — What packers do, and how to get past them — including by hand.
  12. Control Flow Obfuscation, Deep Dive — Flattening, opaque predicates, and systematic deobfuscation.
  13. YARA Rules & Detection — Turn one analysis into scalable, automated detection.
  14. Sigma Rules & Detection Engineering — Turning proven hunts into automated log-based detection.
  15. Anti-Analysis Techniques — Anti-debug, anti-VM, anti-sandbox — and how to see past each.
  16. Malware Triage Methodology — Deciding how much analysis effort a sample actually deserves.
  17. Malware & RE Capstone Lab — A full analysis pipeline against a real sample, start to finish.