Analyzing Malicious Link Files - Identifying Initial Access Techniques

preview_player
Показать описание
Malware authors use a variety of methods to help them gain an initial foothold on an endpoint.

🔥 FREE DOWNLOADABLE PDF - MALICIOUS DOCS QUICK REFERENCE

In this video, we'll analyze three different link (or LNK) files to see how they are abused. We'll use basic tools to grab their content and procmon to capture activity. This will allow us to understand where the next stage payload is coming from and identify the potential threat.

Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!

Sample SHA2s, can be found on Malware Bazaar:
60701bdae4b33de7c53e4a0708b7187f313730bd09c4c553847134f268160a73 buenoroff
bdd7f44f8f1a8b962f5eea74b609c06e792bbf9def807bb7b5bcc81d6aef4533 guildma
3bf1e10ec328ccd9d99e88e2767686851c501426c946ba4e86248d409e880b35 qbot

00:00 Introduction
00:34 The First LNK File
00:45 The LNK File Extension in Windows
01:21 LNK File Properties
01:36 VIewing LNK Target Property
02:27 The Next LNK File - Qbot
03:19 File #3
03:53 Viewing the Command in VSCode
04:42 Using ProcMon to Capture Activity
05:26 Analyzing the Process Tree
06:40 Viewing Strings
07:08 Viewing the Full Command
Рекомендации по теме
Комментарии
Автор

Another great video, thanks for sharing!

roikri
Автор

Hi can you please do a video on how to setup a safe sandbox or testing environment? I understand that a VM can be used, but can't viruses jump out of a virtual environment to the host machine?

zoomingby
Автор

Very interesting! Thanks for the tutorial.

KenPryor