6 - DarkSide Ransomware Rebuilding the IAT (Import Address Table)
Preview unavailable
You must log in or sign up to view this lesson.
Login
Sign up
Malware Analyst Professional - Level 2
Buy now
Learn more
Lab Deployment
Malware Analysis Lab OVA Deployment
Module 1: Introduction to Reverse Engineering
For serious people only - MAoS - Malware Analysis on Steroids.mp4
1 - Course Introduction
2 - Intro to Reverse Engineering - Part 1
3 - Intro to Reverse Engineering - Part 2
4 - Bitwise Operations
Module 2: Understanding Windows API Functions
1 - Introduction to Windows API Functions
2 - Configuring Debug Symbols
3 - Reading MSDN Documentation
4 - Understanding Windows API Functions - Part 1
5 - Understanding Windows API Functions - Part 2
Module 3: The world of Code Injection
High-Level Code Injection Steps
Process Injection.PNG
Process Injection Poster - Part 1.pdf
Process Injection Poster - Part 2.pdf
CreateRemoteThread.cpp
1 - Introduction to Code Injection
2 - Process Injection Classification
3 - Process Injection using CreateRemoteThread
4 - Process Hollowing - Part 1
5 - Process Hollowing - Part 2
Module 4: Dancing with Self-defending Malware
FlawedAmmyy Sample - space1.zip
Anti-Analysis Intro
AntiWorld.cpp
1 - Introduction to Anti-Analysis
2 - Anti-Debugging - Part 1
3 - Anti-Debugging - Part 2
4 - Anti-VM - Part 1
5 - Anti-VM - Part 2
6 - Anti-VM - Part 3
7 - Anti-AV
Module 5: Fighting Packed Malware to the Death
Packing Overview
Lab Instructions
1 - Introduction to Packers and the Unpacking Process
2 - Unpacking the WannaCry Ransomware.mp4
3 - Manual Unpacking of UPX Packed Malware.mp4
More unpacking examples in the bonus section
Module 6: Malicious Shellcode Analysis
Shellcode Sample.zip
Shellcode Analysis Introduction
1 - Introduction to Shellcode Analysis
2 - Shellcode Reverse Engineering - Part 1
3 - Shellcode Reverse Engineering - Part 2
4 - Shellcode Reverse Engineering - Part 3
Module 7: Ransomware Reverse Engineering
DarkSide Ransomware Sample + IDB.zip
1 - DarkSide Ransomware Initial Analysis
2 - DarkSide Ransomware Runtime Code Unpacking - Part 1
3 - DarkSide Ransomware Runtime Code Unpacking - Part 2
4 - DarkSide Ransomware Runtime Code Unpacking - Part 3
5 - DarkSide Ransomware Dynamic API Resolve
6 - DarkSide Ransomware Rebuilding the IAT (Import Address Table)
7 - DarkSide Ransomware TTPs Dissection - Part 1
8 - DarkSide Ransomware TTPs Dissection - Part 2
Module 8: Reverse Engineering .NET Malware
Sunburst Sample.zip
SolarWinds Sunburst Malwarr Entry Point.png
Labs Instructions
1 - SolarWinds Sunburst Backdoor Initial Analysis
2 - SolarWinds Sunburst Backdoor Backtracking (Function Call Tree Analysis)
3 - SolarWinds Sunburst Backdoor Reverse Engineering - Part 1
4 - SolarWinds Sunburst Backdoor Reverse Engineering - Part 2
5 - SolarWinds Sunburst Backdoor Reverse Engineering - Part 3
6 - SolarWinds Sunburst Backdoor Reverse Engineering - Part 4
7 - SolarWinds Sunburst Backdoor Reverse Engineering - Part 5
Bonus Module: More Manual Unpacking Examples
Manual Unpacking of PECompact Packed Malware.mp4
Manual Unpacking of ASPack Packed Malware.mp4