{"id":861,"date":"2020-05-22T21:47:13","date_gmt":"2020-05-22T21:47:13","guid":{"rendered":"https:\/\/hackemall.live\/?p=861"},"modified":"2020-05-22T23:08:25","modified_gmt":"2020-05-22T23:08:25","slug":"malware-analyst-roadmap","status":"publish","type":"post","link":"https:\/\/hackemall.live\/index.php\/2020\/05\/22\/malware-analyst-roadmap\/","title":{"rendered":"Malware Analyst Roadmap"},"content":{"rendered":"\n<p class=\"has-text-align-center has-medium-font-size\"><strong><span class=\"has-inline-color has-luminous-vivid-orange-color\">Ch\u00e0o c\u00e1c b\u1ea1n \u0111\u1ebfn v\u1edbi m\u00f4n Ph\u00f2ng ch\u1ed1ng ngh\u1ec7 thu\u1eadt h\u1eafc \u00e1m &#8211; Ph\u00f2ng ch\u1ed1ng m\u00e3 \u0111\u1ed9c<\/span><\/strong><\/p>\n\n\n\n<p>N\u1ebfu c\u00e1c b\u1ea1n \u0111\u00e3 quy\u1ebft \u0111\u1ecbnh t\u00ecm hi\u1ec3u ngh\u1ec1 n\u00e0y, th\u00ec c\u0169ng xin gi\u1edbi thi\u1ec7u \u0111\u00f3 l\u00e0 m\u1ed9t trong 4 nh\u00f3m ngh\u1ec1 m\u00e0 anh ThaiDN c\u00f3 nh\u1eafc t\u1edbi [1]. C\u00f4ng vi\u1ec7c ch\u00ednh c\u1ee7a ch\u00fang ta l\u00e0m trong m\u1ed9t doanh nghi\u1ec7p \u0111\u00f3 l\u00e0 t\u00ecm ki\u1ebfm, ph\u00e2n t\u00edch, v\u00e0 ti\u00eau di\u1ec7t m\u00e3 \u0111\u1ed9c bao g\u1ed3m c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch. M\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 l\u00e0 virus m\u00e1y t\u00ednh, trojan hay c\u00e1c lo\u1ea1i malware n\u00f3i chung v\u00e0 c\u00e1c m\u00e3 khai th\u00e1c 0-day ch\u01b0a \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn. <\/p>\n\n\n\n<p>\u0110\u01b0\u01a1ng nhi\u00ean, trong th\u1ef1c t\u1ebf c\u00f4ng vi\u1ec7c m\u00e0 t\u00f4i \u0111\u00e3 tr\u1ea3i nghi\u1ec7m \u1edf m\u1ed9t v\u00e0i c\u00f4ng ty t\u1ea1i Vi\u1ec7t Nam th\u00ec c\u00f2n c\u1ea7n n\u00e2ng c\u1ea5p c\u00e1c h\u1ec7 th\u1ed1ng hi\u1ec7n t\u1ea1i \u0111\u1ec3 ch\u1ed1ng l\u1ea1i c\u00e1c k\u1ef9 thu\u1eadt c\u1ee7a m\u00e3 \u0111\u1ed9c, t\u1ed1i \u01b0u h\u1ec7 th\u1ed1ng \u0111\u1ec3 ph\u00e1t hi\u1ec7n c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c ch\u01b0a \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn, x\u00e2y d\u1ef1ng h\u1ec7 th\u1ed1ng ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c t\u1ef1 \u0111\u1ed9ng, x\u00e2y d\u1ef1ng quy tr\u00ecnh x\u1eed l\u00fd s\u1ef1 c\u1ed5 &#8211; ph\u1ea3n \u1ee9ng khi c\u00f3 t\u1ea5n c\u00f4ng m\u00e3 \u0111\u1ed9c,\u2026 <strong>C\u00f4ng vi\u1ec7c n\u00e0y c\u00f3 v\u1ebb s\u1ebd r\u1ea5t kh\u00f3 kh\u0103n v\u00e0 c\u1ea7n \u0111\u1ebfn c\u00e1c ki\u1ebfn th\u1ee9c c\u01a1 b\u1ea3n nh\u1ea5t c\u1ee7a ng\u00e0nh C\u00f4ng ngh\u1ec7 th\u00f4ng tin nh\u01b0: L\u1eadp tr\u00ecnh ng\u00f4n ng\u1eef b\u1eadc th\u1ea5p, l\u1eadp tr\u00ecnh ng\u00f4n ng\u1eef b\u1eadc cao, hay n\u00f3i chung l\u00e0 c\u1ea7n ph\u1ea3i bi\u1ebft v\u00e0 c\u00f3 th\u1ec3 l\u00e0m vi\u1ec7c \u0111\u01b0\u1ee3c v\u1edbi h\u1ea7u h\u1ebft c\u00e1c ng\u00f4n ng\u1eef l\u1eadp tr\u00ecnh<\/strong>. V\u00ec m\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 t\u1ed3n t\u1ea1i \u1edf b\u1ea5t k\u1ef3 d\u1ea1ng ng\u00f4n ng\u1eef l\u1eadp tr\u00ecnh n\u00e0o. C\u00f3 am hi\u1ec3u v\u1ec1 ki\u1ebfn tr\u00fac H\u1ec7 \u0111i\u1ec1u h\u00e0nh, ki\u1ebfn tr\u00fac vi x\u1eed l\u00fd tr\u00ean nhi\u1ec1u n\u1ec1n t\u1ea3ng kh\u00e1c nhau. Tuy nhi\u00ean, c\u0169ng c\u1ea7n l\u01b0u \u00fd r\u1eb1ng kh\u00f4ng y\u00eau c\u1ea7u b\u1ea1n ph\u1ea3i ghi nh\u1edb v\u00e0 bi\u1ebft h\u1ebft m\u1ecdi ki\u1ebfn th\u1ee9c. V\u00ed d\u1ee5 c\u00f3 th\u1ec3 tra c\u1ee9u c\u00e1c c\u00e2u l\u1ec7nh c\u1ee7a Intel x64 khi b\u1ea1n ch\u01b0a nh\u1edb h\u1ebft \u0111\u01b0\u1ee3c to\u00e0n b\u1ed9 c\u00e1c c\u00e2u l\u1ec7nh, nh\u01b0ng y\u00eau c\u1ea7u c\u1ea7n ph\u1ea3i bi\u1ebft \u0111\u01b0\u1ee3c c\u00e1c l\u1ec7nh c\u01a1 b\u1ea3n.<br>N\u00f3i l\u00e0 ph\u1ea3i bi\u1ebft nhi\u1ec1u nh\u01b0 th\u1ebf, nh\u01b0ng ch\u0103m ch\u1ec9 luy\u1ec7n t\u1eadp v\u00e0 th\u1ef1c h\u00e0nh nhi\u1ec1u s\u1ebd quen d\u1ea7n v\u1edbi c\u00f4ng vi\u1ec7c, v\u00e0 \u0111\u1ebfn m\u1ed9t l\u00fac n\u00e0o \u0111\u00f3 b\u1ea1n c\u00f3 th\u1ec3 hi\u1ec3u m\u00e3 \u0111\u1ed9c nh\u01b0 nh\u1eefng ng\u01b0\u1eddi l\u1eadp tr\u00ecnh ra n\u00f3.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-large\"><p><strong><span class=\"has-inline-color has-vivid-cyan-blue-color\">I. Ki\u1ebfn th\u1ee9c n\u1ec1n t\u1ea3ng<\/span><\/strong><\/p><\/blockquote>\n\n\n\n<p>\u0110\u1ed5i v\u1edbi c\u00e1c ki\u1ebfn th\u1ee9c n\u1ec1n t\u1ea3ng c\u1ee7a b\u1ed9 m\u00f4n n\u00e0y, y\u00eau c\u1ea7u c\u01a1 b\u1ea3n l\u00e0 c\u1ea7n c\u00f3 <strong>ki\u1ebfn th\u1ee9c v\u1ec1 l\u1eadp tr\u00ecnh \u0111\u1eb7c bi\u1ec7t l\u00e0 l\u1eadp tr\u00ecnh h\u1ee3p ng\u1eef v\u00e0 l\u1eadp tr\u00ecnh C<\/strong>. Hai m\u00f4n n\u00e0y \u0111\u1ed1i v\u1edbi c\u00e1c b\u1ea1n trong m\u00f4i tr\u01b0\u1eddng \u0110\u1ea1i h\u1ecdc \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u00e0o t\u1ea1o r\u1ed3i, n\u00ean kh\u00f4ng c\u1ea7n ph\u1ea3i gi\u1edbi thi\u1ec7u th\u00eam.<\/p>\n\n\n\n<p><br>Cu\u1ed1n s\u00e1ch \u0111\u1ea7u ti\u00ean c\u1ea7n tham kh\u1ea3o l\u00e0 cu\u1ed1n <strong>&#8220;Secret of Reversing &#8211; EldadEilam&#8221; [2]<\/strong>. <\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>Cu\u1ed1n s\u00e1ch n\u00e0y s\u1ebd cung c\u1ea5p l\u1ea1i cho b\u1ea1n ki\u1ebfn th\u1ee9c v\u1ec1 d\u1ecbch ng\u01b0\u1ee3c ph\u1ea7n m\u1ec1m, t\u1eeb ng\u00f4n ng\u1eef l\u1eadp tr\u00ecnh b\u1eadc th\u1ea5p, tr\u00ecnh bi\u00ean d\u1ecbch,\u2026 hi\u1ec3u \u0111\u01b0\u1ee3c c\u00e1ch m\u00e0 m\u00e1y t\u00ednh th\u1ef1c thi c\u00e2u l\u1ec7nh khi ch\u00fang ta bi\u00ean d\u1ecbch t\u1eeb m\u00e3 ngu\u1ed3n ph\u1ea7n m\u1ec1m. V\u00e0 &#8220;d\u1ecbch ng\u01b0\u1ee3c&#8221; l\u00e0 qu\u00e1 tr\u00ecnh m\u00e0 ta hi\u1ec3u \u0111\u01b0\u1ee3c c\u00e1ch ph\u1ea7n m\u1ec1m ho\u1ea1t \u0111\u1ed9ng t\u1eeb c\u00e1c ng\u00f4n ng\u1eef b\u1eadc th\u1ea5p m\u00e0 tr\u00ecnh disassembler hi\u1ec3n th\u1ecb. Cu\u1ed1n s\u00e1ch n\u00e0y c\u0169ng s\u1ebd gi\u1edbi thi\u1ec7u v\u1ec1 ki\u1ebfn tr\u00fac c\u00e1c th\u00e0nh ph\u1ea7n tr\u00ean H\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows, c\u00e1ch hi\u1ec3n th\u1ecb l\u1eddi g\u1ecdi h\u00e0m, ti\u1ebfp \u0111\u00f3 l\u00e0 c\u00e1ch s\u1eed d\u1ee5ng m\u1ed9t s\u1ed1 c\u00f4ng c\u1ee5 cho c\u00f4ng vi\u1ec7c d\u1ecbch ng\u01b0\u1ee3c nh\u01b0 IDA Pro, Ollydbg. C\u00e1ch th\u1ee9c m\u00e0 m\u00e3 \u0111\u1ed9c s\u1eed d\u1ee5ng \u0111\u1ec3 m\u00e3 h\u00f3a, l\u1ea9n tr\u00e1nh c\u00e1c ph\u1ea7n m\u1ec1m Antivirus. <\/p>\n\n\n\n<p>\u0110\u1ed1i v\u1edbi <strong>Ch\u01b0\u01a1ng 7<\/strong>, n\u1ebfu c\u00e1c b\u1ea1n ch\u1ec9 c\u1ea7n t\u00ecm hi\u1ec3u v\u1ec1 m\u00e3 \u0111\u1ed9c m\u00e0 kh\u00f4ng quan t\u00e2m t\u1edbi khai th\u00e1c l\u1ed7i ph\u1ea7n m\u1ec1m th\u00ec kh\u00f4ng c\u1ea7n tham kh\u1ea3o. Nh\u01b0ng n\u1ebfu \u0111\u1ecdc th\u00ec c\u00e1c b\u1ea1n s\u1ebd c\u00f3 ki\u1ebfn th\u1ee9c c\u01a1 b\u1ea3n v\u1ec1 vi\u1ebft m\u00e3 khai th\u00e1c ph\u1ea7n m\u1ec1m, cu\u1ed1n s\u00e1ch t\u1eadp trung v\u00e0o c\u00e1c ph\u1ea7n m\u1ec1m ch\u1ee7 y\u1ebfu tr\u00ean Windows. <\/p>\n\n\n\n<p>Trong <strong>Ch\u01b0\u01a1ng 8<\/strong> l\u00e0 ch\u01b0\u01a1ng nh\u1eadp m\u00f4n v\u1ec1 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c, gi\u1edbi thi\u1ec7u c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c v\u00e0 c\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a n\u00f3. Sang<strong> ch\u01b0\u01a1ng 9<\/strong> th\u00ec c\u00f3 th\u1ec3 t\u00ecm hi\u1ec3u \u0111\u1ec3 b\u1ebb kh\u00f3a ph\u1ea7n m\u1ec1m ho\u1eb7c thi\u1ebft k\u1ebf m\u1ed9t module \u0111\u1ec3 b\u1ea3o v\u1ec7 b\u1ea3n quy\u1ec1n ph\u1ea7n m\u1ec1m. C\u00e1c ph\u1ea7n c\u00f2n l\u1ea1i cung c\u1ea5p cho c\u00e1c b\u1ea1n ki\u1ebfn th\u1ee9c v\u1ec1 c\u00e1c k\u1ef9 thu\u1eadt \u0111\u1ec3 m\u00e3 ch\u1ed1ng l\u1ea1i nh\u1eefng ng\u01b0\u1eddi d\u1ecbch ng\u01b0\u1ee3c ph\u1ea7n m\u1ec1m, c\u00e1c k\u1ef9 thu\u1eadt \u0111\u1ec3 ph\u00e1t hi\u1ec7n \u0111ang b\u1ecb d\u1ecbch ng\u01b0\u1ee3c hay k\u1ef9 thu\u1eadt ph\u00e1t hi\u1ec7n m\u00f4i tr\u01b0\u1eddng \u1ea3o h\u00f3a m\u00e0 m\u00e3 \u0111\u1ed9c th\u01b0\u1eddng d\u00f9ng. M\u1ed9t ch\u00fat ki\u1ebfn th\u1ee9c v\u1ec1 d\u1ecbch ng\u01b0\u1ee3c c\u00e1c ph\u1ea7n m\u1ec1m \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf tr\u00ean n\u1ec1n t\u1ea3ng .NET trong <strong>ch\u01b0\u01a1ng 12<\/strong>.<\/p>\n\n\n\n<ul><li><em><span class=\"has-inline-color has-vivid-green-cyan-color\">T\u00f3m l\u1ea1i, cu\u1ed1n s\u00e1ch n\u00e0y n\u1ebfu ki\u00ean tr\u00ec \u0111\u1ecdc v\u00e0 th\u1ef1c h\u00e0nh theo th\u00ec c\u00e1c b\u1ea1n \u0111\u00e3 n\u1eafm \u0111\u01b0\u1ee3c ki\u1ebfn th\u1ee9c c\u01a1 b\u1ea3n v\u1ec1 c\u00e1c m\u00e3 \u0111\u1ed9c, v\u00e0 c\u00f3 th\u1ec3 lao v\u00e0o th\u1ef1c h\u00e0nh ph\u00e2n t\u00edch c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c th\u01b0\u1eddng g\u1eb7p. Th\u1eadm ch\u00ed c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng APT.<\/span><\/em><\/li><\/ul>\n\n\n\n<p>\u0110\u1ec3 b\u1ed3i d\u01b0\u1ee1ng ki\u1ebfn th\u1ee9c v\u1ec1 n\u1ec1n t\u1ea3ng H\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows, c\u00e1c b\u1ea1n c\u0169ng c\u00f3 th\u1ec3 tham kh\u1ea3o cu\u1ed1n s\u00e1ch <strong>&#8220;Windows Internal&#8221;[3]<\/strong> bao g\u1ed3m 2 ph\u1ea7n, ph\u1ea7n 1 gi\u1edbi thi\u1ec7u v\u1ec1 User-mode, ph\u1ea7n 2 gi\u1edbi thi\u1ec7u v\u1ec1 Kernel-mode c\u1ee7a H\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows. C\u00e1c ki\u1ebfn th\u1ee9c n\u00e0y l\u00e0 h\u1ebft s\u1ee9c c\u1ea7n thi\u1ebft khi ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c. N\u1ea3n th\u00e2n t\u00f4i c\u0169ng v\u1eabn coi cu\u1ed1n s\u00e1ch n\u00e0y l\u00e0 cu\u1ed1n s\u00e1ch &#8220;g\u1ed1i \u0111\u1ea7u&#8221; khi t\u00ecm hi\u1ec3u v\u1ec1 c\u00e1ch m\u00e0 m\u00e3 \u0111\u1ed9c ho\u1ea1t \u0111\u1ed9ng, v\u00e0 th\u01b0\u1eddng xuy\u00ean \u0111\u1ecdc l\u1ea1i \u0111\u1ec3 tham kh\u1ea3o khi m\u00e0 MSDN kh\u00f4ng ti\u1ec7n \u0111\u1ec3 s\u1eed d\u1ee5ng. Cu\u1ed1n n\u00e0y th\u00ec s\u1ebd s\u1eed d\u1ee5ng xuy\u00ean su\u1ed1t t\u1eeb tr\u00ecnh \u0111\u1ed9 Beginner \u0111\u1ebfn Expert hay Master \u0111\u1ec1u s\u1ebd d\u00f9ng n\u00f3.<\/p>\n\n\n\n<p><strong>&#8220;Practical Malware Analysis&#8221; [4]<\/strong> \u0111\u00e2y l\u00e0 cu\u1ed1n s\u00e1ch m\u00e0 m\u1ed9t trong cu\u1ed1n s\u00e1ch ti\u1ebfp theo<strong> KH\u00d4NG TH\u1ec2 KH\u00d4NG \u0110\u1eccC<\/strong> c\u1ee7a b\u1ed9 m\u00f4n ph\u00f2ng ch\u1ed1ng ngh\u1ec7 thu\u1eadt h\u1eafc \u00e1m. <\/p>\n\n\n\n<p>Cu\u1ed1n s\u00e1ch s\u1ebd \u0111i xuy\u00ean su\u1ed1t v\u00e0 cung c\u1ea5p c\u00e1c kh\u00e1i ni\u1ec7m c\u01a1 b\u1ea3n nh\u1ea5t v\u1ec1 m\u00e3 \u0111\u1ed9c, c\u00e1c k\u1ef9 thu\u1eadt h\u1eafc \u00e1m \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong m\u00e3 \u0111\u1ed9c, v\u00e0 ph\u01b0\u01a1ng ph\u00e1p \u0111i\u1ec1u tr\u1ecb &#8211; kh\u1ed1ng ch\u1ebf c\u00e1c lo\u1ea1i k\u1ef9 thu\u1eadt h\u1eafc \u00e1m n\u00e0y. N\u1ebfu cu\u1ed1n s\u00e1ch &#8220;Secret of Reversing&#8221; cung c\u1ea5p ki\u1ebfn th\u1ee9c v\u1ec1 ki\u1ebfn th\u1ee9c n\u1ec1n t\u1ea3ng v\u1ec1 d\u1ecbch ng\u01b0\u1ee3c ph\u1ea7n m\u1ec1m, th\u00ec cu\u1ed1n s\u00e1ch n\u00e0y cung c\u1ea5p ki\u1ebfn th\u1ee9c n\u1ec1n t\u1ea3ng v\u1ec1 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c. C\u00e1c b\u1ea1n n\u00ean nh\u1edb, <strong>Chuy\u00ean gia l\u00e0 nh\u1eefng ng\u01b0\u1eddi am hi\u1ec3u n\u1ec1n t\u1ea3ng. C\u1ee9 theo nguy\u00ean t\u1eafc 10.000 gi\u1edd luy\u1ec7n t\u1eadp, th\u00ec ch\u1eafc ch\u1eafn s\u1ebd tr\u1edf th\u00e0nh ng\u01b0\u1eddi c\u00f3 kinh nghi\u1ec7m.<\/strong><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-large\"><p><strong><span class=\"has-inline-color has-vivid-cyan-blue-color\">II. M\u00f4i tr\u01b0\u1eddng th\u1ef1c h\u00e0nh<\/span><\/strong><\/p><\/blockquote>\n\n\n\n<p>Cu\u1ed1n s\u00e1ch mang t\u00ednh th\u1ef1c h\u00e0nh h\u01a1n, ki\u1ec3u &#8220;tr\u00ean tay&#8221; &#8211; h\u1ecdc v\u00e0 l\u00e0m lu\u00f4n th\u00ec \u0111\u00f3 l\u00e0 <strong>&#8220;Malware Analyst&#8217;s Cookbook and DVD: Tools and Techniques for Fighting Malicious Code&#8221; [5]<\/strong> b\u1ed9 s\u00e1ch n\u00e0y c\u00f3 cung c\u1ea5p cho c\u00e1c b\u1ea1n t\u1eeb c\u00f4ng c\u1ee5, m\u1eabu m\u00e3 \u0111\u1ed9c, h\u01b0\u1edbng d\u1eabn th\u1ef1c h\u00e0nh t\u1eebng b\u01b0\u1edbc 1. N\u1ebfu nh\u01b0 c\u00e1c b\u1ea1n \u0111\u1ecdc t\u1ed1t Ti\u1ebfng Anh, th\u00ec c\u00f3 th\u1ec3 t\u1ef1 h\u1ecdc &#8211; l\u00e0m v\u00e0 hi\u1ec3u to\u00e0n b\u1ed9 n\u1ed9i dung v\u00e0 c\u00e1c b\u00e0i LAB trong \u0111\u00f3. Cu\u1ed1n s\u00e1ch n\u00e0y n\u00ean \u0111\u1ecdc sau khi c\u00e1c b\u1ea1n \u0111\u00e3 c\u00f3 n\u1ec1n t\u1ea3ng v\u1ec1 d\u1ecbch ng\u01b0\u1ee3c ph\u1ea7n m\u1ec1m, hay n\u00f3i c\u00e1ch kh\u00e1c l\u00e0 \u0111\u00e3 \u0111\u1ecdc cu\u1ed1n s\u00e1ch &#8220;Secret of Reversing &#8211; EldadEilam&#8221; nh\u01b0 \u0111\u00e3 gi\u1edbi thi\u1ec7u \u1edf tr\u00ean, tr\u00e1nh t\u00ecnh tr\u1ea1ng h\u1ecdc v\u1eb9t v\u00e0 l\u00e0m theo h\u01b0\u1edbng d\u1eabn trong s\u00e1ch m\u00e0 kh\u00f4ng hi\u1ec3u b\u1ea3n ch\u1ea5t v\u00e0 tuy duy trong c\u00e1c t\u00ecnh hu\u1ed1ng \u0111\u01b0\u1ee3c nh\u1eafc \u0111\u1ebfn trong s\u00e1ch.<\/p>\n\n\n\n<p>Tham gia c\u00e1c cu\u1ed9c thi ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c, \u0111\u01b0\u01a1ng nhi\u00ean r\u1ed3i c\u00e1c cu\u1ed9c thi lu\u00f4n mang l\u1ea1i c\u1ea3m gi\u00e1c chi\u1ebfn th\u1eb3ng (ho\u1eb7c th\u1ea5t b\u1ea1i), v\u00e0 khi\u1ebfn b\u1ea1n ph\u1ea5n kh\u00edch khi l\u00e0m \u0111\u01b0\u1ee3c g\u00ec \u0111\u00f3. \u0110\u1eb7c bi\u1ec7t trong nh\u1eefng l\u00fac t\u01b0\u1edfng ch\u1eebng nh\u01b0 cu\u1ed9c \u0111\u1eddi qu\u00e1 nh\u00e0n ch\u00e1n v\u1edbi m\u1ea5y n\u00fat F7, F8, F9, F2.<\/p>\n\n\n\n<p><br>H\u00e0ng n\u0103m b\u1eaft \u0111\u1ea7u t\u1eeb 2014, FireEye t\u1ed5 ch\u1ee9c cu\u1ed9c thi t\u1eadp trung v\u00e0o k\u1ef9 thu\u1eadt ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c tr\u00ean m\u1ecdi n\u1ec1n t\u1ea3ng [6], c\u1ea5p \u0111\u1ed9 t\u1eeb kh\u00f3 \u0111\u1ebfn d\u1ec5 cho c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u m\u00e3 \u0111\u1ed9c tr\u00ean kh\u1eafp th\u1ebf gi\u1edbi. Nh\u1eefng ng\u01b0\u1eddi th\u01b0\u1eddng xuy\u00ean ghi danh trong top c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u v\u1edbi t\u1ed1c \u0111\u1ed9c kinh ho\u00e0ng t\u1ea1i Vi\u1ec7t Nam nh\u01b0 yeuchimse, trichimtrich, chuymich,\u2026 C\u00e1c b\u1ea1n ho\u00e0n to\u00e0n c\u00f3 th\u1ec3 t\u1ea3i c\u00e1c th\u1eed th\u00e1ch n\u00e0y t\u1eeb c\u00e1c n\u0103m 2014 \u0111\u1ebfn nay \u0111\u1ec3 t\u1ef1 ph\u00e2n t\u00edch, v\u00e0 n\u1ebfu kh\u00f4ng ra c\u00f3 th\u1ec3 tham kh\u1ea3o c\u00e1c write-up t\u1eeb c\u00e1c nh\u00e0 chi\u1ebfn th\u1eafng c\u1ee7a cu\u1ed9c thi.<\/p>\n\n\n\n<p>Th\u1ef1c h\u00e0nh t\u1eeb c\u00e1c ngu\u1ed3n chia s\u1ebb m\u00e3 \u0111\u1ed9c c\u00f4ng khai. <strong>C\u00e1c ngu\u1ed3n chia s\u1ebb m\u00e3 \u0111\u1ed9c c\u00f4ng khai \u0111\u01b0\u1ee3c \u01b0a th\u00edch hi\u1ec7n t\u1ea1i t\u00f4i th\u01b0\u1eddng s\u1eed d\u1ee5ng nh\u01b0: App.any, Hybird-Analysis, https:\/\/malshare.com\/, https:\/\/www.malware-traffic-analysis.net\/, https:\/\/x.threatbook.cn\/ <\/strong>,\u2026 C\u00e1c ngu\u1ed3n n\u00e0y chia s\u1ebb th\u00f4ng tin v\u00e0 cho ph\u00e9p t\u1ea3i m\u1eabu m\u00e3 \u0111\u1ed9c mi\u1ec5n ph\u00ed. C\u00e1c ngu\u1ed3n th\u00f4ng tin c\u1eadp nh\u1eadt tr\u00ean m\u1ea1ng x\u00e3 h\u1ed9i nh\u01b0 twitter, medium,\u2026 c\u00f3 r\u1ea5t nhi\u1ec1u b\u00e0i ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 tham kh\u1ea3o. Ngo\u00e0i ra, c\u00f3 c\u00e1c b\u00e0i ph\u00e2n t\u00edch c\u00f4ng khai c\u1ee7a c\u00e1c h\u00e3ng b\u1ea3o m\u1eadt chuy\u00ean chia s\u1ebb c\u00e1c b\u00e0i vi\u1ebft ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c uy t\u00edn nh\u01b0: FireEye, Fotinet, Avast, BitDeffender, BlackCarbon (BlackBerry),\u2026 c\u00f3 ng\u01b0\u1eddi \u0111\u00e3 t\u1eadp h\u1ee3p n\u00f3 v\u00e0 s\u01b0u t\u1eadp c\u00e1c m\u1eabu m\u00e3 \u0111\u1ed9c tr\u00ean Github [7].<\/p>\n\n\n\n<p><strong>T\u1ea1i Vi\u1ec7t Nam, c\u00e1c b\u1ea1n c\u0169ng c\u00f3 th\u1ec3 tham kh\u1ea3o c\u00e1c b\u00e0i vi\u1ebft chuy\u00ean v\u1ec1 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c c\u1ee7a c\u00e1c c\u00f4ng ty nh\u01b0 Viettel [8], VinCSS[9], ho\u1eb7c m\u1ed9t s\u1ed1 nh\u00e0 nghi\u00ean c\u1ee9u \u1ea9n danh uy t\u00edn<\/strong>. C\u00e1c b\u00e0i vi\u1ebft n\u00e0y \u0111\u1ec1u ph\u1ea3n \u00e1nh m\u1ed9t ph\u1ea7n n\u00e0o t\u00ecnh h\u00ecnh t\u1ea5n c\u00f4ng m\u1ea1ng t\u1ea1i Vi\u1ec7t Nam, c\u0169ng nh\u01b0 c\u00f4ng vi\u1ec7c th\u1ef1c t\u1ebf m\u00e0 c\u00e1c b\u1ea1n tham gia t\u1ea1i c\u00f4ng ty c\u1ee7a m\u00ecnh. Ho\u1eb7c c\u00e1c b\u1ea1n c\u0169ng c\u00f3 th\u1ec3 l\u1eadp tr\u00ecnh m\u00e3 \u0111\u1ed9c, b\u00ed m\u1eadt g\u1eedi t\u1edbi c\u00e1c c\u00f4ng ty n\u00e0y, bi\u1ebft \u0111\u00e2u \u0111\u00e2y l\u00e0 m\u1ed9t CV ho\u00e0n h\u1ea3o gi\u00fap b\u1ea1n v\u01b0\u1ee3t qua v\u00f2ng ph\u1ecfng v\u1ea5n d\u1ec5 d\u00e0ng. (troll)<\/p>\n\n\n\n<p>\u0110\u1ed1i v\u1edbi c\u00e1c c\u00f4ng c\u1ee5 s\u1eed d\u1ee5ng \u0111\u1ec3 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c. <strong>Ch\u00fang ta c\u00f3 Ollydbg Tutorial c\u1ee7a anh Kienmanowar [10]. C\u00f4ng c\u1ee5 IDA Pro [11], hay h\u01b0\u1edbng d\u1eabn s\u1eed d\u1ee5ng v\u1edbi c\u00f4ng c\u1ee5 Ghidra \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn nh\u01b0 c\u00f4ng c\u1ee5 c\u1ee7a NSA [12]<\/strong> &#8211; tuy t\u00f4i ch\u01b0a t\u1eebng s\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 n\u00e0y. <\/p>\n\n\n\n<p>Nh\u00ecn chung, c\u00e1c c\u00f4ng c\u1ee5 \u0111\u1ec3 s\u1eed d\u1ee5ng trong qu\u00e1 tr\u00ecnh ph\u00e2n t\u00edch kh\u00f4ng qu\u00e1 quan tr\u1ecdng, c\u00f4ng c\u1ee5 ch\u1ec9 gi\u00fap ch\u00fang ta ho\u00e0n th\u00e0nh nhanh h\u01a1n c\u00f4ng vi\u1ec7c, kh\u00f4ng l\u00e0m b\u00e1o c\u00e1o v\u00e0 ph\u00e2n t\u00edch c\u1ee7a ch\u00fang ta t\u1ed1t h\u01a1n n\u1ebfu nh\u01b0 b\u1ea3n th\u00e2n ng\u01b0\u1eddi ph\u00e2n t\u00edch kh\u00f4ng l\u00e0m ch\u1ee7 \u0111\u01b0\u1ee3c c\u00f4ng c\u1ee5 c\u1ee7a m\u00ecnh. Tuy nhi\u00ean, t\u00f4i c\u0169ng khuy\u1ebfn c\u00e1o n\u00ean \u0111\u1ecdc v\u00e0 h\u1ecdc c\u00e1ch s\u1eed d\u1ee5ng m\u1ed9t c\u00f4ng c\u1ee5 n\u00e0o \u0111\u00f3 thu\u1ea7n th\u1ee5c, \u0111\u1ec3 t\u0103ng t\u1ed1c \u0111\u1ed9 ph\u00e2n t\u00edch c\u1ee7a ch\u00fang ta nhanh h\u01a1n. \u0110\u1eb7c bi\u1ec7t trong danh nghi\u1ec7p lu\u00f4n lu\u00f4n s\u1ebd c\u00f3 nh\u1eefng s\u1ef1 c\u1ed1 y\u00eau c\u1ea7u ch\u00fang ta ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c trong v\u00e0i ti\u1ebfng \u0111\u1ec3 c\u00f3 th\u1ec3 c\u01a1 b\u1ea3n s\u1eed l\u00fd \u0111\u01b0\u1ee3c s\u1ef1 c\u1ed1.<\/p>\n\n\n\n<p>\u0110\u1ebfn \u0111\u00e2y, n\u1ebfu c\u00e1c b\u1ea1n \u0111\u00e3 c\u00f3 n\u1ec1n t\u1ea3ng, kinh nghi\u1ec7m t\u1eeb 2-3 n\u0103m chuy\u00ean v\u1ec1 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c l\u00e0 \u0111\u00e3 c\u00f3 th\u1ec3 t\u1ef1 m\u00ecnh ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c tr\u00ean Windows m\u1ed9t c\u00e1ch thu\u1ea7n th\u1ee5c, kh\u00f4ng ph\u1ea3i b\u1ed1i r\u1ed1i qu\u00e1 nhi\u1ec1u khi g\u1eb7p nh\u1eefng m\u1eabu m\u00e3 \u0111\u1ed9c l\u1ea1 ch\u01b0a t\u1eebng g\u1eb7p bao gi\u1edd. Tuy nhi\u00ean, s\u1ebd kh\u00e1 l\u00fang t\u00fang v\u00e0 m\u1ea5t b\u00ecnh t\u0129nh, ki\u00ean nh\u1eabn khi g\u1eb7p nh\u1eefng lo\u1ea1i m\u00e3 \u0111\u1ed9c ph\u1ee9c t\u1ea1p, qu\u00e1 nhi\u1ec1u ch\u1ee9c n\u0103ng, hay \u0111\u01b0\u1ee3c n\u1eb1m trong m\u1ed9t b\u1ecf v\u1ecf b\u1ecdc ch\u1eafc ch\u1eafn m\u00e0 b\u1ea1n kh\u00f3 c\u00f3 th\u1ec3 v\u01b0\u1ee3t qua d\u1ec5 d\u00e0ng. \u0110\u00e3 \u0111\u1ebfn l\u00fac ch\u00fang ta b\u01b0\u1edbc v\u00e0o giai \u0111o\u1ea1n t\u00ecm hi\u1ec3u v\u00e0 nghi\u00ean c\u1ee9u chuy\u00ean s\u00e2u. \u0110\u01b0\u01a1ng nhi\u00ean, t\u1ea1i giai \u0111o\u1ea1n n\u00e0y b\u1ea1n \u0111\u00e3 c\u00f3 th\u1ec3 t\u1ef1 tin ph\u1ecfng v\u1ea5n v\u1edbi b\u1ea5t k\u1ef3 nh\u00e0 tuy\u1ec3n d\u1ee5ng n\u00e0o t\u1ea1i Vi\u1ec7t Nam v\u00e0 c\u00f3 \u0111\u01b0\u1ee3c m\u1ee9c \u0111\u1ea1i ng\u1ed9 h\u1ee3p l\u00fd.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-large\"><p><strong><span class=\"has-inline-color has-vivid-cyan-blue-color\">III. C\u00e1c k\u1ef9 n\u0103ng n\u00e2ng cao<\/span><\/strong><\/p><\/blockquote>\n\n\n\n<p>Th\u1ef1c t\u1ebf ph\u1ea7n \u0111\u00f4ng ch\u00fang ta ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c tr\u00ean n\u1ec1n t\u1ea3ng Windows. Tuy nhi\u00ean, ph\u1ea1m vi c\u00f4ng vi\u1ec7c c\u1ee7a ch\u00fang ta s\u1ebd l\u1edbn h\u01a1n nhi\u1ec1u kh\u00f4ng ch\u1ec9 c\u00f3 v\u1eady. <strong>C\u00e1c m\u00f4i tr\u01b0\u1eddng nh\u01b0 *Nix, Android, OSX, iOS c\u0169ng l\u00e0 n\u01a1i m\u00e0 m\u00e3 \u0111\u1ed9c tr\u00fa ng\u1ee5. <\/strong>V\u00ec th\u1ebf, song song v\u1edbi vi\u1ec7c nghi\u00ean c\u1ee9u v\u00e0 ph\u00e2n t\u00edch c\u00e1c m\u00e3 \u0111\u1ed9c tr\u00ean n\u1ec1n t\u1ea3ng Windows, c\u00e1c b\u1ea1n c\u0169ng s\u1ebd l\u00e0m quen v\u1edbi c\u00e1c m\u00e3 \u0111\u1ed9c tr\u00ean *Nix, tr\u00ean \u0111i\u1ec7n tho\u1ea1i Android, iPhone c\u0169ng nh\u01b0 c\u00e1c m\u00e1y t\u00ednh Macbook. V\u00e0 m\u1edbi n\u1ed5i g\u1ea7n \u0111\u00e2y nh\u1ea5t l\u00e0 c\u00e1c m\u00e3 \u0111\u1ed9c tr\u00ean thi\u1ebft b\u1ecb IoT ho\u1eb7c PLC (Tr\u00ecnh \u0111i\u1ec1u khi\u1ec3n thi\u1ebft b\u1ecb c\u00f4ng nghi\u1ec7p).<\/p>\n\n\n\n<p>\u0110\u1ed1i v\u1edbi c\u00e1c m\u00e3 \u0111\u1ed9c ph\u1ee9c t\u1ea1p, c\u00e1c tr\u00ecnh b\u1ea3o v\u1ec7 lu\u00f4n l\u00e0m kh\u00f3 nh\u1eefng nh\u00e0 ph\u00e2n t\u00edch ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i. B\u1edfi v\u00ec m\u00e3 \u0111\u1ed9c \u0111\u00f4i khi \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf nh\u01b0 nh\u1eefng v\u0169 kh\u00ed trong th\u1eddi \u0111\u1ea1i ng\u00e0y nay. N\u00ean \u0111\u1ec3 b\u1ea3o v\u1ec7 \u0111\u01b0\u1ee3c v\u0169 kh\u00ed \u1ea5y \u0111\u01b0\u1ee3c b\u00ed m\u1eadt, th\u00ec nh\u1eefng ng\u01b0\u1eddi ph\u00e1t tri\u1ec3n m\u00e3 \u0111\u1ed9c s\u1ebd d\u00f9ng m\u1ecdi c\u00e1ch \u0111\u1ec3 b\u1ea3o v\u1ec7, l\u00e0m kh\u00f3 c\u00e1c nh\u00e0 ph\u00e2n t\u00edch, v\u01b0\u1ee3t qua (bypass) c\u00e1c h\u1ec7 th\u1ed1ng ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c t\u1ef1 \u0111\u1ed9ng, ch\u1ed1ng l\u1ea1i m\u00f4i tr\u01b0\u1eddng \u1ea3o h\u00f3a, c\u00f4ng c\u1ee5 dissambler hay c\u00f4ng g\u1ee1 l\u1ed7i,\u2026 Ng\u01b0\u1ee3c l\u1ea1i, c\u00e1c nh\u00e0 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c s\u1ebd c\u1ed1 g\u1eafng l\u00e0m s\u00e1ng t\u1ecf \u0111\u01b0\u1ee3c m\u00e3 \u0111\u1ed9c, d\u00f9 bao nhi\u00eau l\u1edbp b\u1ea3o v\u1ec7 \u0111i ch\u0103ng n\u1eefa, d\u00f9 bao nhi\u00eau th\u1ee7 \u0111o\u1ea1n \u0111\u1ec3 ch\u1ed1ng l\u1ea1i \u0111i n\u1eefa th\u00ec <strong>ng\u01b0\u1eddi ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c c\u0169ng s\u1ebd c\u00f3 ph\u01b0\u01a1ng ph\u00e1p \u0111\u1ec3 m\u1ed5 x\u1ebb v\u00e0 l\u00e0m r\u00f5 m\u00e3 \u0111\u1ed9c. \u0110\u00e2y l\u00e0 l\u00fac m\u00e0 c\u00f4ng l\u00fd lu\u00f4n gi\u00e0nh chi\u1ebfn th\u1eafng, ch\u1eb3ng k\u1ebb th\u00f9 \u00e1c n\u00e0o \u1edf trong b\u00f3ng t\u1ed1i m\u00e3i m\u00e3i =)) .<\/strong><\/p>\n\n\n\n<p>N\u1ebfu \u0111\u00e3 qu\u00e1 nh\u00e0n ch\u00e1n v\u1edbi c\u00e1c lo\u1ea1i malware th\u01b0\u1eddng g\u1eb7p, b\u1ea1n s\u1ebd vi\u1ebft c\u00e1c tr\u00ecnh gi\u1ea3i m\u00e3 v\u00e0 ph\u00e2n t\u00edch t\u1ef1 \u0111\u1ed9ng. Gi\u1ed1ng nh\u01b0 malwareconfig [13]. C\u00e1c lo\u1ea1i Unpacker t\u1ef1 \u0111\u1ed9ng, v\u00e0 c\u00f3 th\u1ec3 gi\u1ea3i quy\u1ebft h\u1ea7u h\u1ebft c\u00e1c lo\u1ea1i crypter, virtualization[14]. X\u00e2y d\u1ef1ng c\u00e1c gi\u1ea3i ph\u00e1p ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c t\u1ef1 \u0111\u1ed9ng, v\u00e0 gi\u1ea3i quy\u1ebft b\u00e0i to\u00e1n kh\u00f3 v\u1ec1 t\u1ed1c \u0111\u1ed9 ph\u00e2n t\u00edch, \u0111\u1ed9 ch\u00ednh x\u00e1c c\u1ee7a h\u1ec7 th\u1ed1ng, ch\u1ed1ng l\u1ea1i c\u00e1c k\u1ef9 thu\u1eadt ph\u00e1t hi\u1ec7n \u1ea3o h\u00f3a c\u1ee7a m\u00e3 \u0111\u1ed9c.<\/p>\n\n\n\n<p>Khi \u0111\u00e3 qu\u00e1 nh\u00e0n ch\u00e1n v\u1edbi c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c t\u1ea1i User-mode, ch\u00fang ta s\u1ebd nh\u1ea5n ch\u00ecm b\u1ea3n th\u00e2n s\u00e2u h\u01a1n n\u1eefa v\u00e0o m\u00f4n ph\u00f2ng ch\u1ed1ng ngh\u1ec7 thu\u1eadt h\u1eafc \u00e1m khi t\u1eeb Ring 3 v\u00e0 Ring 0 c\u1ee7a H\u1ec7 \u0111i\u1ec1u h\u00e0nh. L\u00fac n\u00e0y, b\u1ea3n th\u00e2n s\u1ebd c\u1ea3m th\u1ea5y c\u00f4 \u0111\u1ed9c b\u1edfi v\u00ec quanh ta nh\u1eefng g\u00ec l\u00e0 s\u00e2u s\u1eafc nh\u1ea5t, c\u0103n b\u1ea3n nh\u1ea5t c\u1ee7a h\u1ec7 th\u1ed1ng m\u00e1y t\u00ednh, n\u01a1i m\u00e0 m\u00e3 \u0111\u1ed9c c\u0169ng c\u00f3 th\u1ec3 \u1ea9n gi\u1ea5u b\u1ea3n th\u00e2n k\u00edn k\u1ebd nh\u1ea5t c\u00f3 th\u1ec3. C\u00e1c cu\u1ed1n s\u00e1ch \u0111\u00e3 gi\u1edbi thi\u1ec7u nh\u01b0 Windows Internal ph\u1ea7n 2, hay Practical Malware Analysis \u0111\u1ec1u \u0111\u00e3 nh\u1eafc t\u1edbi c\u00e1c lo\u1ea1i Bootkit, Rootkit. Th\u1ebf nh\u01b0ng \u0111\u1ec3 th\u1ef1c s\u1ef1 nh\u1ea5n ch\u00ecm v\u00e0 h\u1ee5p l\u1eb7n xu\u1ed1ng, ch\u00fang ta c\u1ea7n ki\u00ean nh\u1eabn v\u00e0 k\u1ef7 lu\u1eadt h\u01a1n v\u1edbi b\u1ea3n th\u00e2n v\u1edbi Cu\u1ed1n s\u00e1ch <strong>&#8220;The Rootkit Arsenal&#8221;[15]<\/strong>, v\u00e0 cu\u1ed1n <strong>&#8220;Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats&#8221;[16] <\/strong>gi\u00fap ta l\u00e0m \u0111\u01b0\u1ee3c \u0111i\u1ec1u \u0111\u00f3. Do c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c n\u00e0y kh\u00f4ng xu\u1ea5t hi\u1ec7n ph\u1ed5 bi\u1ebfn, v\u00ec ph\u00e1t tri\u1ec3n c\u00e1c m\u00e3 \u0111\u1ed9c n\u00e0y kh\u00f4ng ph\u1ea3i \u0111\u01a1n gi\u1ea3n, th\u1ebf n\u00ean vi\u1ec7c ph\u00e2n t\u00edch \u0111\u01b0\u1ee3c c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c n\u00e0y c\u0169ng s\u1ebd \u00edt nhi\u1ec1u g\u1eb7p kh\u00f3 kh\u0103n.<\/p>\n\n\n\n<p>C\u00e1c k\u1ef9 n\u0103ng v\u1ec1 ph\u00e2n t\u00edch g\u00f3i tin, k\u1ef9 n\u0103ng forensic, v\u00e0 c\u00e1c k\u1ef9 n\u0103ng v\u1ec1 m\u1eadt m\u00e3 lu\u00f4n c\u1ea7n \u0111\u01b0\u1ee3c c\u1ee7ng c\u1ed1 v\u00e0 h\u1ed7 tr\u1ee3 trong qu\u00e1 tr\u00ecnh ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c. V\u00ec th\u1ebf, \u0111\u1eebng b\u1ecf qu\u00ean c\u00e1c ki\u1ebfn th\u1ee9c v\u1ec1 nh\u1eefng k\u1ef9 n\u0103ng n\u00e0y.<br>S\u00e1ch v\u1ec1 Memory Forensic: <strong>The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory [17]<\/strong><br>S\u00e1ch v\u1ec1 m\u1eadt m\u00e3 &#8211; m\u00e3 h\u00f3a: <strong>Serious Cryptography: A Practical Introduction to Modern Encryption [18]<\/strong>, <strong>Understanding Cryptography: A Textbook for Students and Practitioners [19]<\/strong>. Ki\u1ebfn th\u1ee9c c\u1ea7n thi\u1ebft khi ph\u00e2n t\u00edch c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c s\u1eed d\u1ee5ng m\u1eadt m\u00e3 \u0111\u1ec3 truy\u1ec1n tin, m\u00e3 h\u00f3a d\u1eef li\u1ec7u, m\u00e3 h\u00f3a shellcode, hay c\u00e1c tr\u00ecnh crypter, obfuscater\u2026 \u0110\u1ecdc \u0111\u1ec3 hi\u1ec3u v\u00e0 c\u00f3 kh\u1ea3 n\u0103ng gi\u1ea3i quy\u1ebft c\u00e1c s\u01a1 \u0111\u1ed3 m\u00e3 h\u00f3a c\u01a1 b\u1ea3n.<br>B\u1ed5 sung th\u00eam c\u00e1c ki\u1ebfn th\u1ee9c v\u1ec1 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c: <strong>&#8220;Mastering Malware Analysis&#8221;[20].<\/strong><\/p>\n\n\n\n<p>C\u00f3 th\u1ec3 c\u00e1c chuy\u00ean gia \u0111\u1ea7u ng\u00e0nh kh\u00e1c s\u1ebd g\u1ee3i \u00fd cho c\u00e1c b\u1ea1n bi\u1ebft c\u00e1c h\u01b0\u1edbng l\u00e0m v\u00e0 h\u1ecdc ti\u1ebfp theo, tuy nhi\u00ean \u0111\u1ed1i v\u1edbi t\u00f4i hi\u1ec7n t\u1ea1i \u0111ang d\u1eebng t\u1ea1i \u0111\u00e2y, hy v\u1ecdng s\u1ebd gi\u00fap \u00edch \u0111\u01b0\u1ee3c cho c\u00e1c b\u1ea1n con \u0111\u01b0\u1eddng tr\u1edf th\u00e0nh nh\u1eefng nh\u00e0 ph\u00f2ng ch\u1ed1ng ngh\u1ec7 thu\u1eadt h\u1eafc \u00e1m. Vi\u1ec7t Nam ta s\u1ebd c\u00e0ng c\u00f3 nhi\u1ec1u ng\u01b0\u1eddi ph\u00f2ng ch\u1ed1ng m\u00e3 \u0111\u1ed9c, ch\u1ed1ng l\u1ea1i nh\u1eefng cu\u1ed9c t\u1ea5n c\u00f4ng m\u1ea1ng t\u1eeb Ph\u01b0\u01a1ng B\u1eafc b\u1eb1ng nh\u1eefng chi\u00eau tr\u00f2 h\u1eafc \u00e1m.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-large\"><p><strong><span class=\"has-inline-color has-vivid-cyan-blue-color\">IV. C\u00e1c h\u01b0\u1edbng nghi\u00ean c\u1ee9u h\u1ecdc thu\u1eadt<\/span><\/strong><\/p><\/blockquote>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/hackemall.live\/wp-content\/uploads\/2020\/05\/malware-1024x436.png\" alt=\"\" class=\"wp-image-875\" width=\"768\" height=\"327\" srcset=\"https:\/\/hackemall.live\/wp-content\/uploads\/2020\/05\/malware-1024x436.png 1024w, https:\/\/hackemall.live\/wp-content\/uploads\/2020\/05\/malware-300x128.png 300w, https:\/\/hackemall.live\/wp-content\/uploads\/2020\/05\/malware-768x327.png 768w, https:\/\/hackemall.live\/wp-content\/uploads\/2020\/05\/malware-750x320.png 750w, https:\/\/hackemall.live\/wp-content\/uploads\/2020\/05\/malware.png 1387w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/><\/figure><\/div>\n\n\n\n<p>Ngo\u00e0i l\u00e0m m\u1ed9t k\u1ef9 s\u01b0 m\u00e0i \u0111\u00edt 8 ti\u1ebfng \u1edf c\u00f4ng ty, t\u00f4i c\u0169ng c\u00f3 m\u1ed9t s\u1ed1 h\u01b0\u1edbng nghi\u00ean c\u1ee9u v\u1ec1 h\u1ecdc thu\u1eadt n\u1ebfu c\u00e1c b\u1ea1n n\u00e0o y\u00eau th\u00edch t\u00ecm hi\u1ec3u v\u00e0 nghi\u00ean c\u1ee9u.<\/p>\n\n\n\n<ul><li>X\u00e2y d\u1ef1ng h\u1ec7 th\u1ed1ng ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c t\u1ef1 \u0111\u1ed9ng: H\u01b0\u1edbng nghi\u00ean c\u1ee9u n\u00e0y kh\u00f4ng ph\u1ea3i m\u1edbi, tuy nhi\u00ean c\u00e1c b\u1ed9 m\u00e3 ngu\u1ed3n m\u1edf hi\u1ec7n nay ch\u01b0a \u0111\u00e1p \u1ee9ng \u0111\u01b0\u1ee3c v\u1ec1 \u0111\u1ed9 ch\u00ednh x\u00e1c, hi\u1ec7u n\u0103ng, kh\u1ea3 n\u0103ng th\u00edch \u1ee9ng v\u1edbi m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p. Ch\u00ednh v\u00ec th\u1ebf m\u00e0 \u0111\u1ec1 t\u00e0i nghi\u00ean c\u1ee9u th\u00ec nhi\u1ec1u, t\u1eeb c\u1ea5p \u0110\u1ea1i h\u1ecdc t\u1edbi Cao h\u1ecdc r\u1ed3i cao h\u01a1n n\u1eefa. Nh\u01b0ng \u0111\u1ebfn nay, Ch\u00fang ta v\u1eabn ch\u01b0a c\u00f3 m\u1ed9t s\u1ea3n ph\u1ea9m c\u00f4ng khai n\u00e0o c\u00f3 kh\u1ea3 n\u0103ng th\u01b0\u01a1ng m\u1ea1i h\u00f3a v\u00e0 b\u00e1n ra \u0111\u01b0\u1ee3c n\u01b0\u1edbc ngo\u00e0i. C\u00e1c s\u1ea3n ph\u1ea9m nh\u01b0 App.Any, ThreatBook.cn hay Hybird-Analysis tuy mi\u1ec5n ph\u00ed (c\u00f3 b\u1ea3n tr\u1ea3 ph\u00ed) nh\u01b0ng c\u0169ng r\u1ea5t h\u1eefu d\u1ee5ng v\u00e0 gi\u00fap \u00edch r\u1ea5t nhi\u1ec1u.<\/li><li>H\u01b0\u1edbng nghi\u00ean c\u1ee9u v\u1ec1 AI ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c, BigData \u0111\u1ec3 ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c, Deeplearning \u0111\u1ec3 ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c, m\u00e3 h\u00f3a trong m\u00e3 \u0111\u1ed9c,\u2026. H\u01b0\u1edbng nghi\u00ean c\u1ee9u n\u00e0y b\u1ea1n c\u00f3 th\u1ec3 b\u1eaft g\u1eb7p trong b\u1ea5t k\u1ef3 tr\u01b0\u1eddng \u0110\u1ea1i H\u1ecdc n\u00e0o \u0111\u00e0o t\u1ea1o v\u1ec1 An to\u00e0n th\u00f4ng tin.<\/li><li>X\u00e2y d\u1ef1ng c\u00e1c framework s\u1eed d\u1ee5ng \u0111\u1ec3 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c. V\u00ed d\u1ee5 nh\u01b0 c\u00e1c nghi\u00ean c\u1ee9u v\u00e0 s\u1ea3n ph\u1ea9m c\u1ee7a anh Nguy\u1ec5n Anh Qu\u1ef3nh: Capstone (capstone-engine.org), Unicorn (unicorn-engine.org) &amp; Keystone (keystone-engine.org) \u1ee9ng d\u1ee5ng r\u1ea5t nhi\u1ec1u trong c\u00e1c c\u00f4ng vi\u1ec7c v\u1ec1 ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c.<\/li><\/ul>\n\n\n\n<p>Tr\u00ean \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ed1 g\u1ee3i \u00fd cho c\u00e1c b\u1ea1n chu\u1ea9n b\u1ecb b\u01b0\u1edbc sang n\u0103m cu\u1ed1i, c\u00f3 \u0111\u1ee7 th\u1eddi gian \u0111\u1ec3 t\u00ecm hi\u1ec3u v\u00e0 x\u00e2y d\u1ef1ng \u0111\u1ec1 t\u00e0i. V\u00ec ngo\u00e0i c\u00f4ng vi\u1ec7c h\u00e0ng ng\u00e0y ra, n\u1ebfu ch\u00fang ta c\u00f3 nh\u1eefng \u0111\u00f3ng g\u00f3p v\u1ec1 m\u1eb7t khoa h\u1ecdc, h\u1ecdc thu\u1eadt c\u0169ng s\u1ebd gi\u00fap \u00edch r\u1ea5t nhi\u1ec1u cho c\u00e1c b\u1ea1n sau n\u00e0y.<\/p>\n\n\n\n<p class=\"has-text-align-center\">-*-<\/p>\n\n\n\n<p class=\"has-text-align-center\"><strong><span class=\"has-inline-color has-vivid-purple-color\">C\u00f3 nhi\u1ec1u con \u0111\u01b0\u1eddng \u0111\u1ec3 b\u1ea1n \u0111i theo, kh\u00f4ng nh\u1ea5t thi\u1ebft ph\u1ea3i theo g\u1ee3i \u00fd c\u1ee7a t\u00f4i. B\u1ea3n th\u00e2n t\u00f4i c\u0169ng ch\u1ec9 l\u00e0 m\u1ed9t k\u1ef9 s\u01b0 qu\u00e8n chuy\u00ean F7, F8, F9, F2 ch\u1ee9 c\u0169ng kh\u00f4ng ph\u1ea3i l\u00e0 m\u1ed9t ng\u01b0\u1eddi cao si\u00eau, nh\u01b0ng lu\u00f4n c\u1ed1 g\u1eafng ch\u0103m ch\u1ec9 \u0111\u1ec3 mong mu\u1ed1n ph\u00e1t tri\u1ec3n b\u1ea3n th\u00e2n t\u1ed1t h\u01a1n, v\u00e0 c\u1ee9 theo quy t\u1eafc 10.000 gi\u1edd \u0111\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c m\u1ed9t c\u00e1i g\u00ec \u0111\u00f3. R\u1ea5t mong \u0111\u01b0\u1ee3c s\u1ef1 \u0111\u00f3ng g\u00f3p c\u1ee7a c\u00e1c chuy\u00ean gia kh\u00e1c, v\u00ec m\u1ed9t m\u1ee5c ti\u00eau chung l\u00e0 truy\u1ec1n b\u00e1 k\u1ef9 thu\u1eadt ph\u00f2ng ch\u1ed1ng ngh\u1ec7 thu\u1eadt h\u1eafc \u00e1m t\u1edbi c\u00e1c nhi\u1ec1u ng\u01b0\u1eddi c\u00e0ng t\u1ed1t, \u0111\u1ec3 c\u00f3 kh\u1ea3 n\u0103ng b\u1ea3o v\u1ec7 cho gia \u0111\u00ecnh, t\u1ed5 ch\u1ee9c v\u00e0 v\u00ec m\u1ed9t kh\u00f4ng gian m\u1ea1ng Vi\u1ec7t Nam an to\u00e0n.<\/span><\/strong><\/p>\n\n\n\n<p class=\"has-text-align-center\">&#8212;&#8211;<\/p>\n\n\n\n<p><br>[1] https:\/\/vnhacker.blogspot.com\/2012\/05\/lam-toan-thong-tin-thi-hoc-gi.html<br>[2] https:\/\/www.foo.be\/cours\/dess-20122013\/b\/Eldad_Eilam-Reversing__Secrets_of_Reverse_Engineering-Wiley(2005).pdf<br>[3] https:\/\/www.amazon.com\/Windows-Internals-Part-Developer-Reference\/dp\/0735648735<br>[4] https:\/\/nostarch.com\/malware<br>[5] https:\/\/www.oreilly.com\/library\/view\/malware-analysts-cookbook\/9780470613030\/<br>[6] http:\/\/flare-on.com\/<br>[7] https:\/\/github.com\/CyberMonitor\/APT_CyberCriminal_Campagin_Collections<br>[8] https:\/\/blog.viettelcybersecurity.com\/<br>[9] http:\/\/blog.vincss.net\/<br>[10] https:\/\/kienmanowar.wordpress.com\/category\/ollydbg-tutorials\/<br>[11] https:\/\/nostarch.com\/idapro2.htm<br>[12] https:\/\/nostarch.com\/GhidraBook<br>[13] https:\/\/malwareconfig.com<br>[14] https:\/\/www.blackhat.com\/presentations\/bh-usa-07\/Yason\/Whitepaper\/bh-usa-07-yason-WP.pdf<br>[15] https:\/\/www.amazon.com\/Rootkit-Arsenal-Escape-Evasion-Corners\/dp\/1598220616<br>[16] https:\/\/www.amazon.com\/Rootkits-Bootkits-Reversing-Malware-Generation-ebook\/dp\/B07P8J5HZJ\/<br>[17] https:\/\/www.amazon.com\/Art-Memory-Forensics-Detecting-Malware-ebook\/dp\/B00JUUZSQC\/<br>[18] https:\/\/www.amazon.com\/Serious-Cryptography-Practical-Introduction-Encryption-ebook\/dp\/B0722MTGQV\/<br>[19] https:\/\/www.amazon.com\/Understanding-Cryptography-Textbook-Students-Practitioners-ebook\/dp\/B014P9I39Q<br>[20] https:\/\/www.packtpub.com\/networking-and-servers\/mastering-malware-analysis<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ch\u00e0o c\u00e1c b\u1ea1n \u0111\u1ebfn v\u1edbi m\u00f4n Ph\u00f2ng ch\u1ed1ng ngh\u1ec7 thu\u1eadt h\u1eafc \u00e1m &#8211; Ph\u00f2ng ch\u1ed1ng m\u00e3 \u0111\u1ed9c N\u1ebfu c\u00e1c b\u1ea1n \u0111\u00e3 quy\u1ebft \u0111\u1ecbnh t\u00ecm hi\u1ec3u ngh\u1ec1 n\u00e0y, th\u00ec c\u0169ng xin gi\u1edbi thi\u1ec7u \u0111\u00f3 l\u00e0 m\u1ed9t trong 4 nh\u00f3m ngh\u1ec1 m\u00e0 anh ThaiDN c\u00f3 nh\u1eafc t\u1edbi [1]. C\u00f4ng vi\u1ec7c ch\u00ednh c\u1ee7a ch\u00fang ta l\u00e0m trong m\u1ed9t [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":875,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,19],"tags":[],"_links":{"self":[{"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/posts\/861"}],"collection":[{"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/comments?post=861"}],"version-history":[{"count":17,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/posts\/861\/revisions"}],"predecessor-version":[{"id":882,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/posts\/861\/revisions\/882"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/media\/875"}],"wp:attachment":[{"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/media?parent=861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/categories?post=861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hackemall.live\/index.php\/wp-json\/wp\/v2\/tags?post=861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}