Welcome back everyone to another video expert malware analysis and reverse engineering. 1
We will now proceed with the delivery and exploitation phase. 2
And from this phase the real malware action begins and that's how we are going to now proceed with much 3
more of hands on exercises rather than theoretical exercises. 4
So before we move ahead let us quickly go through the details of delivery and exploration. 5
And we will again be using the example of Spearphishing e-mail. 6
So what is exactly SpearPhishing. 7
So SpearPhishing is a technique that is used by attackers to basically launch a targeted attack against 8
any given individual or against any given corporate. 9
So if you remember other discussions from our previous videos, we talked about the reconnaissance and weaponization 10
phase and then we said that the attacker collects information about the host or about the target or 11
about the organization and based on the collected information it crafts that the weaponization stage and one 12
once the weaponized file is created it will use a delivery mechanism to kind of initiate the attack 13
pattern. 14
This is what is listed here in step number one two three and four. 15
So what is special about SpearPhishing and how is it different from phishing. 16
Now this is an important difference to understand. A lot of times interviewers in cyber security positions 17
They ask you this question like What is the difference between a fishing attack and a SpearPhishing 18
attack. 19
Well a fishing attack is a very broad attack where the attackers send malicious e-mail to say thousands 20
of e-mail addresses. 21
They don't really care about who gets infected or they don't really target a specific individual or organization. 22
Their goal is to target as many people as possible and they send that e-mail to a lot of targets. 23
In SpearPhishing emails, 24
they are more tailor-made towards particular individual or towards particular organization. 25
Some of the common examples are the CEO scams that you see where some of the particular employees of 26
a company, especially the employees who are working in the finance department are usually scammed by 27
sending an e-mail which looks like it came from the CEO of the company and they would ask him to transfer 28
some money from the official bank account to some other bank account. 29
So that's more about SpearPhishing, where they're specifically targer individuals or organizations. 30
So let us quickly talk about e-mails as a delivery factor. 31
So in the delivery phase once recon and weaponization file has been generated, 32
The attackers can use e-mail as a delivery vector. So it can be targeted phishing attack where the attackers 33
can specifically try and send the e-mails to particular individuals inside the organization. 34
For example people who might have higher accesses within the organization, let's say system administrators 35
if you managed to compromise a system administrator's account then you can get a lot of privileges inside 36
in the network. 37
It is specific to a group of people and organization. 38
It's hard to detect as they are tailor made to look genuine. 39
So for a normal human it might be difficult to really create differences between a legitimate email 40
and SpearPhishing email. 41
Since SpearPhishing e-mails are pretty much targeted, they are very nicely crafted and they would very 42
much look like a legitimate email. We look at a bunch of examples starting from the next video. 43
So that's the reason why sphere phishing emails are also difficult to detect compared to normal phishing 44
emits. In-case offer email as a delivery vector, victims are asked to download malicious attachments, 45
click on embedded URLs or reply with sensitive information. What can be the steps to identify 46
malicious e-mails. 47
You should carefully assess the sender who sent you that e-mail. 48
Don't just go by the display name that comes in. 49
Also look at the e-mail address that was registered for that particular display name because a lot of 50
times the display name might be some something that can be very familiar to you. 51
For example John or Peter or some common name which you might be knowing that particular person. 52
So it's always wise to carefully look at the sender details. 53
Looking at the message body. 54
Now this is slightly on the technical tracks how we look at the message headers to basically see where 55
that e-mail actually originated from. 56
We will be looking into much more details. 57
In next we'll ask you how we can analyze an e-mail message body. Also carefully assess any embedded 58
links and attachments that are there 59
in the given email 60
This can help you in being much more vigilant and avoid from clicking on unsolicited links or opening 61
any unsafe attachment in your corporate network. 62
So that's all for the delivery phase. In the next 63
video, we are going to give much more detail and technical review of how we can analyze SpearPhishing emails. 64
So that's it for this video. 65
Thanks for watching.