Decode Malware Strings with Conditional Breakpoints

Description: In this video, we explore how to deobfuscate malware strings using conditional breakpoints in x64dbg.

Timestamps:
0:00 - Intro
1:26 - Running capa
2:39 - Analysis with Ghidra
4:20 - Static file analysis with CFF Explorer
4:40 - Debugging with x64dbg
7:32 - Introducing conditional breakpoints
14:35 - Conditional breakpoints for code deobfuscation

Have malware analysis questions or topics you'd like me to cover? Leave a comment and let me know!

SANS Malware Analysis Courses I Author and Teach:

Password: infected
Description: Malware for conditional breakpoint demos

Tools

Documentation:

Referenced Videos:

[matthewlandry]

Anuj! Great well explained video! Thanks for all the hard work you put into these. Keep it up! 👏

[michaelf]

Another great video Anuj! Looking forward to seeing more. It helps with my course in Advanced Malware Analysis from Zero 2 Automated!!!

[somedieyoungZZ]

Wondeful video !
I know how much time it takes to make this high quality content
Keep it up Anuj ! Hope you keep making more videos
Can you make one about Manually Unpacking Malware ? I'd love to share some samples with you

[boogieman]

Thanks a lot Anuj! Apart from your technical knowledge I appreciate the didactic knowledge even more!! Very well explained

[uchoangviet]

Great videos. I have learned many things from here. Hopefully there will be more content on the topic of obfuscating malware from you in the near future

[somedieyoungZZ]

Wondeful Video ! I know how much time it takes to pump out these high qualites video
Keep it up Anuj ! Any plans on making a video on manually unpacking malware ? I'd love to give some samples for it
Thanks 😄

[neloangelo__]

Learned a lot from this one, thank you Anuj :)

[jacktaubl]

Keep it up, videos are always fantastic!

[mustaphaaitichou]

Anuj ! thank you for your effort and shariing this insighful content that worth :)

[aliihsansenel]

well explained and well presented thank you

[steled]

You can also do the filtering in the logfile using notepad++ itself instead of using de find command.
This can be done by marking all lines containing the OUTPUT string and then remove all non marked lines.

[lumikarhu]

great stuff! have john h. learn from you before streaming any malware related content again! :-)

[mojack]

Well explained @anuj … making a video on .net malware deobfuscation will also be very helpful …. 🙏🙏🙏

[blueteams]

Hi Anuj, Thanks for making a video on this topic, conditional breakpoints are highly underrated. Could you pls make video on tracing and its uses. There are a few ppl taking about it uses or significance.

[michaelf]

Hi Anuj, just a quick question. In this decoding of the strings. Is there a way to decode them and see their associated indexes? Thanks again!

[logiciananimal]

Great video. Why are there are all the int instructions after the call to VirtualProtect (I think they're breakpoints, but the number seems excessive to me.)?

[fernandoaguilar]

Maybe I have to fill some knowledge gap here... but how did you know the decoded strings at 7:19 in the video were UTF-16?

[SejTuSe]

I'm trying to apply your method to get password for protected file packed with InnoSetup which dropping malware. I already found function with Capa which you showed. Thanks a lot.

[christophertharp]

TY, from capa hwo did you know the 4th address was the xor function?

[mauserqh]

Great video Anuj..! Will try all this for sure.. Thanks a lot..!!

Can please make another fantastic video on debugging running processes (attach/attach to debugger)??

Context is like:-
debugging a.exe <launched> b.exe, now wanted to debug b.exe process at the same time..

Thanks in advance..!! :)