A comprehensive university course repository for learning malware analysis through hands-on labs and real-world samples.
RPISEC/Malware is a complete educational repository containing lecture slides, labs, projects, and real malware samples for a university-level malware analysis course. It provides a structured, hands-on curriculum to teach skills in reverse engineering, malicious behavior identification, and anti-analysis techniques. The materials are designed around the *Practical Malware Analysis* book and include encrypted malicious samples for safe practice.
University students, security researchers, and aspiring malware analysts with a background in C/C++ and basic assembly, looking for a practical, lab-driven introduction to malware analysis.
It offers a rare, fully-developed academic course with real malware samples and a comprehensive toolset, all freely available. Unlike generic tutorials, it provides a complete semester's worth of structured, hands-on material developed and tested in a university setting.
Course materials for Malware Analysis by RPISEC
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Follows a 12-lecture progression from basic static analysis to advanced rootkit techniques, providing a clear learning path aligned with the Practical Malware Analysis book.
Includes 10 labs and 4 projects using encrypted, real-world malware samples (password: 'infected'), enabling practical experience in a safe, controlled environment.
Bundles essential analysis tools like IDA Free, OllyDbg, and Wireshark in the releases, reducing setup time and cost for learners.
Designed around the Practical Malware Analysis textbook, with lectures assuming prior reading, making it an effective companion for structured self-study.
Based on a 2015 syllabus, it lacks coverage of modern malware families, techniques (e.g., PowerShell-based attacks), and updated tools, requiring supplemental learning.
Requires creating a Windows 7 32-bit VM with specific tools, which is time-consuming and not provided due to Windows licensing, as admitted in the README.
The README states no recordings were made, limiting learning to sparse slides and self-guided practice without live demonstrations or explanations.
Assumes working knowledge of C/C++ and assembly, making it inaccessible for beginners without additional foundational study, as outlined in the prerequisites.