Skip to content

> malware-development --learn

Learn how malware is built, lesson by lesson.

Study how malware is structured, how its mechanisms interact, and how implementation choices shape behavior. Progress from C fundamentals to operating-system boundaries, communications, persistence, evasion, and impact.

Start learningView learning path
lessons
22
Module
10

// Malware development: the learning path

A progressive course in malware internals: foundations, architecture, operating systems, configuration, communications, persistence, injection, evasion, capabilities, and engineering. Work through explanations, inert models, source studies, and exercises.

Start learning →

  1. 013 lessons

    Foundations

    Follow program flow and learn to read real malware source.

  2. 022 lessons

    Program architecture

    Understand how internal handlers are selected and organized.

  3. 034 lessons

    Memory and operating systems

    Connect processes, threads, memory, executable formats, and API boundaries.

  4. 041 Lesson

    Configuration and data

    Separate settings, serialized data, encoding, and cryptographic claims.

  5. 052 lessons

    Commands and communications

    Read protocol boundaries, message state, and data movement.

  6. 061 Lesson

    Persistence and execution

    Distinguish an execution trigger, a stored artifact, and its security context.

  7. 071 Lesson

    Process boundaries and injection

    Understand execution location and the evidence needed to identify injection.

  8. 082 lessons

    Environment checks and obfuscation

    Understand conditional behavior, packing, and the limits of environment signals.

  9. 093 lessons

    Collection, credentials, and impact

    Study capability boundaries, credential lifecycles, ransomware, and data loss.

  10. 103 lessons

    Builds, testing, and source studies

    Connect build artifacts to source, test inert models, and complete a capstone.

// Browse all lessons

  1. 01Program flow: from entry point to behavior
  2. 02Reading Mirai source: a string comparison trap
  3. 03Languages, platforms, and executable artifacts
  4. 04Malware architecture: command dispatch tables
  5. 05Lifecycle: initialization, state, and failure paths
  6. 06Processes, threads, and memory ownership
  7. 07APIs, libraries, and security context
  8. 08Platform abstractions: shared logic and native backends
  9. 09User mode, kernel components, and rootkit claims
  10. 10Configuration, serialization, and encoding
  11. 11Messages, protocols, and data movement
  12. 12Botnet architecture: topology, roles, and coordination
  13. 13Persistence: triggers, artifacts, and lifecycle
  14. 14Process injection and execution context
  15. 15Anti-Debugging: IsDebuggerPresent (Windows)
  16. 16Environment signals, obfuscation, and packing
  17. 17Credential access, discovery, and capability boundaries
  18. 18Privilege escalation and lateral movement boundaries
  19. 19Ransomware: data lifecycle, keys, and impact
  20. 20Builds, packaging, and component boundaries
  21. 21Testing inert models and interpreting observations
  22. 22Capstone: explain a component from source to behavior