Hello and welcome back.
In this new session.
We are going to do a particle of analyzing real world mail, whether it is in some way.
So be careful and remember the use of your machine.
So in this first video in this session, I will talk to you about the principles, analyzing the some
ransomware.
What is your sense of ransomware?
It's a malware that restricts access to data by encrypting files or locking computer screens and attempts
to extort money from victims in a form of crypto currencies.
After encrypting the files, it displays a ransom note with instructions of how to pay and recover the
files in one of the following ways it might show a desktop wallpaper.
The ransom note as the wallpaper or in my redirect you to a website with instructions.
Or it may display a Pop-Up message.
Typical stages of a malware attack, many malware artists who make use of a document in order to start
the first attack, for example, in my use a Microsoft Office document or a Java binary file or even
link, and this could be sent to the victim via emails or put on websites for you to download.
So once a victim has downloaded a document, the victim might open the document and then might trigger
and execute an embedded script.
For example, PowerShares script or visual basic script or JavaScript or even an embedded native EIC
executable file.
And that site, the document itself.
So this could normally kind of drop in order to go out to the Internet and download the second stage
of the attack.
The second stage of the attack will be the actual malicious malware itself, which may do further damage
to your system.
For example, in criminal files, some malware or install remote access to if it is intended to steal
information from the target system.
Features a ransom, the.
A ransomware would typically attempt to locate all critical files, for example, document files or
images and encrypt them and delete the original file.
Mostly, they will use strong cryptography.
So it's not possible to recover ransom files with a key ransom when they also look for network shares
and attached storage.
And he may even spread to other computers within a system or in a network.
Some rental agreement also contains additional functionality, for example, and back door to enable
remote access by the hacker, or they could be having the ability to do crypto mining, for example,
to mine for bitcoins or cryptocurrency.
So in this session, you will be downloading real malware, ransomware for practice.
Go and download the file copies, dot net, real world and somewhere down from the resource section
for this lesson, use a virtual machine.
This is real random.
The password on unzip it is cracking lessons that come workflow for analyzing ransomware.
Below is a list of some possible workflow when analyzing malicious malware.
First, you might want to check the virus Twitter to see if there are any signatures that can identify
the family for this particular malware.
Second, you might want to do a scan for strings that is embedded inside the malware itself.
This trace may give you a hint as to for the things that you need to look for in going to with the analysis.
All the strings may even give you a hint or idea of what he is capable of doing or even his intentions.
And sometimes the strings might also show indicators of compromise like you are ALS or other links goes
out to the Internet to download second stage bill.
Then you might also want to proceed to do dynamic analysis where you will actually run the malware,
perform analysis on it.
You can use densify to reverse engineer the malware itself, that is to decompiled into the source code.
And then you might also want to defeat any anti analysis mechanisms that are already guilty.
Email me and you also want to find indicators of compromise or no artifacts.
So thank you for watching.
I'll see you in the next three days.
Good luck in your analysis.