mether049-malware/README.md

# malware
マルウェア関連(調査・解析結果，ツール，解析手法等)
- [Malware techniques(reference&memo)](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md)
  - [Anti-analysis/detection](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#anti-analysis)
    - [Injection/Hollowing](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#injectionhollowing)
    - [Heavens's Gate](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#heavens-gate)
    - [API obfuscation](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#api-obfuscation)
    - [PowerShell Script obfuscation](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#powershell-script-obfuscation)
    - [Living Off The Land(LOL)](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#living-off-the-landlol)
    - [DGA](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#dga)
    - [Fast Flux](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#fast-flux)
    - [Convert to c2 proxy server(Using UPnP)](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#convert-to-c2-proxy-serverusing-upnp)
    - [DNS Tunneling](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#dns-tunneling)
    - [Using SSL/TLS](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#using-ssltls)
    - [Pakcing](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#packing)
    - [Anti-Unpacking](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#anti-unpacking)
    - [Mutex](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#mutex)
    - [Poisoning CRT Library](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#poisoning-crt-library)
  - [Persistence](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#persistence-1)
    - [Registry](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#registry)
    - [Startup Folder](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#starup-folder)
  - [Gathering Information](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#gathering-information)
    - [Public IP address](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#public-ip-address)
  - [Delete Data](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#delete-data)
    - [Delete Volume Shadow](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#delete-volume-shadow)
  - [maldoc](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#maldoc)
    - [Obfuscation/Encryption](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#obfuscationencryption)
    - [VBA Stomping](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#vba-stomping)
  - [Malicious JavaScript](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#malicious-javascript)
  - [Shell Backdoor](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#shell-backdoor)
  - [rootkit](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#rootkit)
    - [LKM rootkit](https://github.com/mether049/malware/blob/master/malware-tech_ref_and_memo.md#lkm-rootkit)
    
- [Malware analysis method(reference&memo)](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md)
  - [Tools](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#tools)
    - [VM/OS](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#osvm)
    - [Static Analysis and Debug tools](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#static-analysis-and-debug-tools)
    - [Tracer](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#tracer)
    - [Instrumentation](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#instrumentation)
    - [Traffic Analysis tools](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#traffic-analysis-tools)
    - [Forensic](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#forensic)
    - [Threat hunting](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#threat-hunting)
    - [.NET analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#net-analysis)
    - [Utilities](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#utilities)
    - [Online Sandbox](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#online-sandbox)
    - [Unpacker/Decryptor/Decoder/Extractor/Memory Scanner](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#unpackerdecryptordecoderextractormemory-scanner)
  - [PDF Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#pdf-analysis)
  - [Document file Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#docment-file-analysis)
  - [JavaScript Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#javascript-analysis)
  - [Linux Command Line Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#linux-command-line-analysis)
  - [Other various file Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#other-various-file-analysis)
    - [lnk file](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#lnk-file)
  - [C2 Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#c2-analysis)
    - [Emotet](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#emotet)
    - [Ursnif](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#ursnif)
  - [Binary Analysis](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#binary-analysis)
    - [Unpacking](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#unpacking)
    - [Microsoft Windows Library](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#microsoft-windows-library)
    - [Perspective](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#perspective)
  - [Windows OS](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#windows-os)
  - [Windows Command](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#windows-command)
  - [Training Material](https://github.com/mether049/malware/blob/master/malware-analysis_ref_and_memo.md#training-material)
- [Emotet](https://github.com/mether049/malware/tree/master/Emotet)
- [Trickbot](https://github.com/mether049/malware/tree/master/Trickbot)
- [Maldoc used by TA505]()
- Knowledge
    - [Identification of Hollowed out processes](https://github.com/mether049/malware/blob/master/detecting_ph_process.md)