This is going to sound fishy.

Recently getting into cybersecurity things and have been pretty interested in looking at malware and maybe making some myself to get the hang of it. Do you guys know any good repositories with malware to learn from? For example, if I wanted to make a credential stealing program, there’s a lot of different programs that may have credentials that are valuable. Or, maybe writing a keylogger? I took a look at a rust crate that can record keystrokes but has kind of a weird (or at least not as easy) type system because of different OS implementations, but how do different types of malware consolidate those differences?

I guess the broader question I’m getting at specifically is looking at how already made programs get around different technical obstacles like detailed above.

Thanks

  • Mikina@programming.dev
    61·
    1 month ago

    I can’t recommend Maldev Academy enough. It has been an amazing resource, to get into malware development. Keep in mind, however, that malware development is pretty difficult topic. You will have to eventually use WinAPI and syscalls, so learning about that even outside of malware development will help you a lot.

    For example, try looking into how to execute a shellcode in memory - allocate memory as RWX, copy some data and then execute it. Try executing it in a different process, or in a different thread of another process. That’s the core of malware development you’ll probably eventually have to do anyway. Manually calling syscalls is also a skill that you’ll need, if you want to get into EDR avoidance.

    Also, look into IoCs and what kind of different stuff can be used to detect the malware. Syscall hooks, signatures, AMSI, and syslog are all things that are being watched and analyze to detect malware, and knowing what exactly is your program logging and where is one of the most important and difficult skills you can get.

    There probably are a lot resources for these two skills, and they are an important foundation for malware developemnt, so I’d suggest researching that. You’ll probably not get much from looking at other malware, because it tends to be really low-level, and obfuscated, exactly to avoid the IoCs I’ve mentioned above. Implementing the malware behavior after that is the easier part.