Hands-on Ransomware: Exploring Cybercrime

00:00 - Ryan Chapman, Malware Analyst
00:30 - Introduction
04:29 - First Demo
07:29 - Configuring RAASNet
15:58 - Building RAASNet
18:17 - Detonating RAASNet
21:41 - Builder Archive
23:37 - Second Demo
26:20 - Building Yashma
27:54 - Third Demo
30:08 - Configuring Lockbit
35:01 - Building Lockbit
37:50 - Final Thoughts

🔥 YOUTUBE ALGORITHM ➡ Like, Comment, & Subscribe!

[creengton]

I’d love to see more of Ryan, hoping he’ll start his own yt channel

[ThisIsJustADrillBit]

Thank you! The shadowy world relies on secrecy and silence. This effort to teach and explore is so important. The more light you shine, and the more sparks of interest it inspires, the less room there is for the darkness.

[cyberguide_in]

Extremely informative. I'd love to see Ryan discussing malware analysis as he mentions at the video's end. Much appreciated Ryan and John!

[reanimationxp]

Wild to see an old work buddy on one of my favorite YouTube channels.. go Ryan!

[axjv]

26:46 The ASCII art actually broke the builder. Probably would have worked if you took it out. Whoever wrote that should sanitize their strings…

[sutfuf]

It's happened before, it will happen again! I saw something similar in the 90's. VCL, IIRC, by Nowhere man of nuke. It was a DOS TUI for creating viruses and the like. It was basically an x86 ASM code generator. You'd select type: com, exec infectors, droppers, etc... type of payload, custom strings and the like. It was password protected, but, if you were skilled with debug tools, you could extract it.

[WanderlustVisual]

Waiting for Ryan's Malware analysis things and how he does it in real world cases.

[Jesse_Johnson]

Some of the best cysec content on planet earth. Thanks Ryan. Killer vid

[ChuckWholery-ik]

Great content! Good to see that you synced up with John Hammond! Keep up the great work Ryan!!

[ianADFE]

That login is ridiculously easy to bypass. Just supply a profile dictionary object and execute the code in the last if statement in the login function.

[Lodakia]

I may have missed this if it was already answered in the video. But is the VM image he's using with all of those analysis programs on the desktop publicly available?

[lordlightspeed]

There was actually an option to change the extension when building it. You just skipped past that screen.

[tmcarter]

Great content and advisors.. Thanks for keeping this topic in the front of the line!

[roninx_]

Hello John, can you review PNPT certification? How the course is, and what are the preps to do for the exam. And suggestions for machines to do in THM and HTB. It'll be helpful for me to uptake the certification 🥺

[AlienWarTycoon]

I'd like to know what coffee Ryan drinks. I'll have some of that please.

[mauipomare]

ive been searching for a while now to help me learn about this subject, i want to start my own channel but its hard to get a hold of entire intact how to docs so i can teach this on my channel, i think its crazy how select education is blocked, because this is my ikigai

[CU.SpaceCowboy]

i wonder if any ransomware type crypters have ever used something like sdelete to overwrite empty space on disk to mitigate possible file recovery. or just create a file that eats up free space than deletes after disk is full

[slr]

16:35 Rust doesn't have a runtime!

[arunrmyt]

Wow this is old LockBit though. New versions have made the decrytor not available on the system. They are preparing this on thir systesm and dropping to the victim.

[jugalchaudhary]

how can we stop lockbit ramsomeware from getting into my computer?