🦔 📹 Video: Building your own AI Malware Analysis Lab
➡️ old system, 16 GB RAM
➡️ using Remnux
#MalwareAnalysisForHedgehogs #LLM
www.youtube.com/watch?v=YOdu...
🦔 📹 New video: NodeJs analysis when deobfuscator fails
➡️ #MythJs stealer sample
➡️ pkg VFS exploration tool
➡️ js-confuser
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=gtLq...
🦔 📹 New Video: Can office files be malicious without Macros?
➡️ VSTO Add-Ins
➡️ External Templates
➡️ Checklist for Office analysis
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=RtHH...
🦔 📹New Video: RenPy game loads stealer, beginner friendly
➡️ strategies for finding malware in 2956 files
➡️ extracting and decompiling RenPy
➡️ remote access tool config extraction
➡️ unpacking native payload
#MalwareAnalysisForHedgehogs #RenPy
www.youtube.com/watch?v=Fmfg...
🦔📹 New Video: Modifying string decrypter for a ConfuserEx2 variant
➡️ Defeating antis with Harmony hooks
➡️ AsmResolver
➡️ .NET string deobfuscation
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=sARn...
🦔 📹 Video: Analysis of malicious NordVPN setup
➡️ beginner-suitable
➡️ sorry, no spoilers here ;)
www.youtube.com/watch?v=5-OY...
#MalwareAnalysisForHedgehogs
🦔 📹 New video: What breakpoints to set for unpacking malware?
➡️ Steps of unpacking stub
➡️ Breakpoint targets
➡️ VirtualAlloc from user to kernel mode
#MalwareAnalysisForHedgehogs #Unpacking
www.youtube.com/watch?v=fn8r...
🦔 📹 New Video: There is more than Clean and Malicious
➡️ 7 file analysis verdicts and what they mean
#MalwareAnalysisForHedgehogs #Verdicts
www.youtube.com/watch?v=XwT2...
🦔 📹 Virut Part III: File infection analysis and bait file creation
#MalwareAnalysisForHedgehogs #Virut
www.youtube.com/watch?v=FcXP...
Virut part II: process infection and NTDLL hooking 🦔📹
➡️x64dbg scripting
➡️conditional breakpoints
➡️more import table resolving
➡️fixing control flow
➡️marking up hook code
#MalwareAnalysisForHedgehogs #Virut
www.youtube.com/watch?v=nuxn...
🦔 📹New Video: Analysis of Virut - Part I
➡️ self-modifying code
➡️ Ghidra markup decryption stub
➡️ API resolving
➡️ unpacking
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=250B...
🦔 📹 New Video: Unpacking Lumma Stealer
We continue where we left off last time and unpack the Emmenhtal to Pure Crypter to Lumma Stealer chain.
www.youtube.com/watch?v=aenO...
#MalwareAnalysisForHedgehogs #LummaStealer
🦔 📹 New Video: Binary Refinery deobfuscation of a LummaStealer loader (PowerShell, JScript)
www.youtube.com/watch?v=kHU_...
#MalwareAnalysisForHedgehogs #PowerShell #JScript
🦔 📹 Video: Learn how to write code based signatures
➡️ using privateloader as example
➡️ what to detect
➡️ where to set wildcards
➡️ how to test your rule on unpac me
www.youtube.com/watch?v=oxC9...
#MalwareAnalysisForHedgehogs #privateloader
New video: Why antivirus software detects cracks as malware or PUP 🦔📹
#MalwareAnalysisForHedgehogs #cracks #antivirus
www.youtube.com/watch?v=KA7R...
🦔 📹 New Video: D3fack loader analysis
➡️ Inno Setup pascal script analysis
➡️ string deobfuscation with binary refinery
➡️ JPHP decompilation
Sample was first described by @RussianPanda9xx
www.youtube.com/watch?v=y09Z...
#MalwareAnalysisForHedgehogs #D3fackLoader
New Video: Why malware simulators cannot tell you if a malware or technique is detected by AV🦔📹
(... unless they were specifically made for that product)
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=yJZC...
🦔 📹 Triaging 9 Samples on VirusTotal
➡️ Why does Bitdefender dominate the detection rate?
➡️ Why do launchers look so suspicious?
➡️ Why does well-known shellcode have a low detection rate?
#MalwareAnalysisForHedgehogs #VirusTotal
www.youtube.com/watch?v=v8fR...
New Video: Unpacking JScript -> PowerShell -> XWorm with Binary Refinery
#MalwareAnalysisForHedgehogs #XWorm
www.youtube.com/watch?v=5Ztm...
🦔📹 New Video: Unpacking Methods overview and when to use them. 📦
➡️ Run and dump
➡️ Debugger and breakpoints
➡️ Self-extracting patch
➡️ Emulation
➡️ Static unpacking
#MalwareAnalysisForHedgehogs #Unpacking
youtu.be/z2r06ByQAus?...
New Video: Unpacking payload from AutoIt-based stub 🦔 📹
2 ways: fast guessing or thorough analysis
➡️ extracting AutoIt script
➡️ finding relevant code in large scripts
➡️ string decryption
➡️ quick shellcode analysis
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=xzxg...
New Video: Deobfuscation of JScript malware like GootLoader using 3 methods 🦔
➡️ regex
➡️ AST manipulation
➡️ dynamic deobfuscation
#GootLoader #MalwareAnalysisForHedgehogs #AST #JScript
www.youtube.com/watch?v=Djap...