Hello, my name is Stefan.
And in this lecture, we are going to look for strings.
And let's start by opening the project, by double clicking on the run, that part and after that.
Here we are seeing this kind of dialogue here.
Welcome screen.
Click on the close and here we will come to file new project here.
Searching for strings in Lena.
Here.
Drink search.
Elena.
Malware and this is the project name for us.
And after that we will drag and drop our exe file.
Or you can press on the E on your keyboard and just select this, your malware here.
And that's it.
Here we have format.
We will select a portable executable.
By default, we have language.
Obviously we can't we can't change it because here already knows that it is.
It has compiler called Visual Studio here and program name is Sparc dot X.
So this is just an representation.
So it actually this is this name is just for you so you can change it anything you want.
More descriptive names like Lena malware or POS malware here.
Click on.
Okay and loading language here and importing the file here we are seeing what is happening with Ghidra.
And.
It might take like ten or 20s depends on your computer specifications and it's done.
We have the import results summary.
As always, we will click on okay.
And after that we will right click on the post malware.
And we will click on the open in default window.
After that.
Do Ravel?
Ask us.
Do you want to?
Analyze this.
So, of course, we want to analyze this.
And here it is checked by default.
We will not touch anything for now.
And we will click on the analyze.
After that, it might take some time.
Here in the right bottom corner of the screen, you can see the progress.
And while our progress is running, we cannot scroll that down.
Let's increase the font size a little bit for you.
We have the.
Undefined thunk function.
Here we have several codes.
It's almost the compiling here.
The loading process is here.
Let's get the call functions here.
Push and here.
So it's almost done here.
We're just playing with it.
And let's actually check the functions and.
Imports from the symbol tree.
Can we increase the font size a bit?
No.
Sorry.
And here we have the win init.
So here we are.
Program our malware is using.
Some of the Internet protocol libraries.
So this might.
Told us that.
Our program has access to Internet or sending something here.
And as you can see, it's almost all Http.
So it means our malware is using port 80 Http protocol and our loading is almost done here.
Let's also check out another import URL man So we have the URL download to file a.
So this means our program can also install something, install the files or programs from internet.
We have the kernel32 the win in it again and internet read file, internet, open, connect, close
handle and so on.
We have URL man url download file and at the vapid 32.
This is also manipulating for registry keys.
Control service, create service A, and so on.
Now.
This is fun.
Yes.
And that's it.
Our analysis has been done.
And after that, let's start by.
Uh, going to search here.
Search menu here.
And at the bottom here, we have search for strings.
And you will not touch anything because we don't want.
We want, uh, the minimum length of five, So.
And alignment one and word modal string model at G.
So you can also change the word modal if you have one, but probably this hedras word modal will work
and after that we will click on search.
And here, as you can see, we have several.
Strings here.
So.
We will go to we will search for it and find something interesting here.
You can also use these filters, for example, if you want to like.
That eggs are here.
Let's.
And here we have the several Xs strings.
Our program has connections with tools Excel files.
And here we have the wind defender that exit here.
So we will check that address location for F 647 A and that's it.
And here, as you can see, we will get our marker.
Here we have this let's actually use different.
Here.
So we have this installed with the vendor that X.
We have.
Oh, shellcode.
Mutex might be interesting, right?
And we also have SSD to hook that PDB.
And we have that password might be interesting, right?
Password.
And this program cannot run in RDS mode and so on.
And we should also have something like.
That's it.
And here we also have the desktop in here.
When you see users desktop alien source working debug spark dot P as shown here, the user Benson seems
to have compiled this malware, so this information could be useful to investigate the attribution of
this malware.
So there are a lot of suspicious strings here, right?
So this URL in here is probably the.
Compiler of this malware.
Transparent.
So Alan the some someone that.
A count named Allen on a Windows machine compiled this.
Malware.
And we have the Benson This is the computer name.
The.
Machine name.
So.
Machine name, balancer.
And user name is Allen.
And we have some suspicious password here.
Like after password, we have the probably the real password here that's also of Sorry.
Let's also take this.
And this is some suspicious password.
Let's note it down here.
Uppercase, y, h and g.
Y l key.
O0.
Nine H.
Uppercase and trans frame with white background.
So this is some password here and we have the shellcode mutex and SSD hooked PDB here and here, for
instance.
So it's hard to imagine the reason behind the legitimate program making reference to win defender here.
Right?
So it's also making some reference to win defender.
So it's probably the bad program here, right?
The malware and also here the shellcode that mutex shellcode that mutex and win defender here.
So especially the shellcode that mutex and the system.
This SSD here.
So let's let me note it down.
Psst, psst.
Here is system service, sir.
Service.
Dispatch table.
So.
Also just making regular program, hooking this to this service.
References are both explicitly malicious and a quick overview of these strings of the program can sometimes
reveal whether it is malware or not.
Without further analysis and simple and powerful.