Malware Analysis -- LIVE -- [SillyPutty.exe]

preview_player
Показать описание
--- -

In this video, I demonstrate the following:
- Analyzing strings in the malware to make a hypothesis of what is going on
- Using procmon after detonating the malware to discover host-based indicators and the payload being delivered
- Using Wireshark to monitor the network-based indicators the malware is calling out to
- Decrypting a Base64 payload and performing code review to discover the port it's calling out to
- and much more ...

Enjoy!!
---------------------
Let's connect:
This content is intended for educational purposes only. All demonstrations and techniques shown are designed to teach ethical hacking and improve cybersecurity. Any use of the information provided in these videos is done at your own risk and should be used responsibly. Unauthorized hacking, illegal activities, or violations of privacy are not endorsed or encouraged. Always ensure you have proper authorization before attempting any security testing or hacking.
Рекомендации по теме
Комментарии
Автор

P.S. -- If anyone gets to the end, the reason I could not see the TCP traffic is in Procmon I set "Operation IS TCP" but it needs to be "Operation CONTAINS TCP" :)

TylerRamsbey
Автор

Hey Tyler what software do you use to record your screen? I want to start recording my session as well to document my learning journey as I go.

steven_branham
Автор

in powershell script you got the gzip compress, the easy and quicker ways. echo "base64-encoded-value" >> tempfile, and "file tempfile" will genrally tell you the file format. and than you can gunzip tempfile.

kumardineshwar