Welcome to the Introduction to Windows
Malware Development course from 0X12 Dark
Development OK If you're curious about
how malware works, how attackers exploit
Windows systems, and how defenders detect
them, this course is your starting
point. OK, this course.
It's designed to give you a technical,
hands on introduction to the fundamentals
of malware development on Windows. We
focus on practical techniques that real
malware uses, dissecting them from a
developer's perspective so you can
understand both how to vault and how to
defend it. OK, perfect, perfect. And this
will be the topics that. We will see
in this in this course, OK, First of
all, we will start with the introduction
that it's this video after this setup to
create the same environment on me, OK.
And when this is done, we can start
with the topic course, OK, First of all,
the first category of lessons, it's the
shell. We are generating payloads
with MSF Venom from metasploit OK and
after this using the generated shellcode.
We are explaining what is shellcode, why
we want to use the shell code
and by using techniques to execute the
shell code. The first of all the
classic shellcode execution some
functions. Call it enumerate enum to
execute the shell code and executing the
shell code via timer OK. Once this
is done, we will start encrypting our
share code to make it harder to
detect by the security defense like
antivirus or address using a gas or
chore OK and shore sorry.
Both options are, uh, very good and we
will see them in the in the following
videos. After this, we start the process
injection that basically it's the
shellcode execution, but in the space in
the context of another process. OK, we
are executing our shellcode, but in
another process we start with the
classic. Process injection. Then we use
the asynchronous procedure call injection
technique. After this the thread
hijacking injection and finally the final
window injection. Once this is done, we
jump to the DLL injection steps. OK,
DLL injections lessons. First of all we
will see simple simple lesson about the
violin. Fiction. And after this how to
make persistent DLL injection. Nice.
Great. Once this is done, we jump
to the interprocess connection section.
OK, in this section we will see
various lessons with various options to
make interprocess connection. OK, we will
see how to make the interprocess
connection. Bips, musics and registries.
Once this is done we go to
the dollar. There OK, we will see
how to create a malware that downloads
the payload from Internet. OK from a
typical HTTP, Https://petition. Then we
jump to the multi platform malware. OK,
we will create a malware from 32
and 64. UH-64UH, Windows systems
OK for both platforms. For
both architectures we will creating
the same EXE OK. After
this we will see the
malware as a service.
To install our X as a service
in the system. And then another important
topic is the persistence. OK, we will
see two different things to.
Performed to approach the persistence in
the system using run register case and
via application events. Once this is done
we jump to the import address table
that basically it's a lesson where we
bypass the. Import address
table. Then Dumpty sandbox.
It's interesting to then allow
the any malware analyst to
execute our malware in sandboxes
or virtual machines.
OK, then we jump to the
string encryption that we are encrypting
our strings of the of our
malware, the strings of our malware
to make unreadable and basically then
we still have valid Microsoft signatures
and we put these signatures in
our ex. In our model perfect. After
this we will create a reverse shell using
C. Then OK,
I came over to uh to
look each stroke from the from
the victim skateboards. After this we
will I will show you.
Windows Defender Killer simple
tool to permit permit
permanently delete Windows Defender
from the victim system.
And then an orange so interesting
section. It's the privilege escalation
where we will see different techniques,
these 3 foot helper, token manipulation
and finally a Class C class
where we combine both to escalate
privileges, one of these techniques to
escalate. Villages from user to admin and
the other one is to scale privileges from
admin to entity of thority system. OK
perfect. After this we jump to the API
hooking where we will see how to set
U it. We explain what it what is
it and finally we create RDP credential
stealer tool. To steal credentials from
the RDP protocol. OK, after this
we go to the parent Peter
spoofing video. But it's a simple
technique to create the spoofing from
the planning process. And after this
we jump to the process token.
We will see techniques like token.
People Action talked impersonation.
Various techniques OK finally the vamp
Elsa's process is interesting to steal
credentials from the victim system and
the final project of this course
will be as simple simple bonnet
so simple bonnet where we will
see the server side tackling side
after this we will just. Go
through the conclusions video that will
end this course. OK, And that's all from
this course. OK? That's all the videos
that all the sections and all the lessons
of this course.
To get the most value from this
course you should have a basic
understanding of C++ OK. Also you will
need to familiarity with Windows.
Operating system internals and it will
be so useful when not necessary.
Some experience using tools like MSF,
Venom, the Devil X64 Debugger or
Process Hacker that are. They are
so simple to understand and you
can find YouTube tutorials. And with 10
minutes of tutorial you can understand
these tools OK.
So.
Basically, it's this head over to the
next video to set up your lab
and prepare to write your feet first
payload. This is the real world of
malware simulated safely, taught
ethically and void from scratch. OK and
finally, just a simple a simple
disclaimer OK to. Remind you that
this source is strictly for educational
and research purposes, OK? All techniques
shown must only be used in isolated
lab environments with proper
authorization. OK. These techniques can
cannot be executed in a system that
you don't have permissions if you execute
these techniques in a system that you
don't have. Emissions. This will be
illegal, OK. So this
misuse of this acknowledge is illegal and
historically against the principles of
the 0X Dark Development Academy. OK, so
that's all. Let's start and let's enjoy
this course. Thank you so much and
let's go to the next video.