OALabs
OALabs
  • 125
  • 1 685 506
Zombieware
Self-replicating malware, long abandoned by its operators, continues to contribute significant volume and noise to malware feeds. We investigate this trend, which we refer to as Zombieware!
Join us on Patreon for Part 2 where we reverse engineer a popular file infector and write an extractor to recover the infected files!
www.patreon.com/posts/zombieware-part-103656376
Full Zombieware blog post can be found on our UnpacMe blog here: blog.unpac.me/2024/04/25/zombieware/
Ladislav Zezula's excellent talk from BSides Prague can be found here:
czcams.com/video/OgXvd-Wce9o/video.html
-----
OALABS DISCORD
discord.gg/oalabs
OALABS PATREON
www.patreon.com/oalabs
Twitch
www.twitch.tv/oalabslive
OALABS GITHUB
github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
www.unpac.me/#/
-----
zhlédnutí: 3 412

Video

Introduction to YARA Part 4 - Efficient Rule Development16:43Introduction to YARA Part 4 - Efficient Rule Development
Introduction to YARA Part 4 - Efficient Rule Development
zhlédnutí 2,5KPřed 6 měsíci
In this OALABS Patreon tutorial we cover the foundations of writing efficient YARA rules and provide some tips that can help speed up your YARA hunting. The full notes for this tutorial are unlocked for everyone on our Patreon www.patreon.com/posts/introduction-to-96638239 OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON www.patreon.com/oalabs Twitch www.twitch.tv/oalabslive OALABS GITHUB gi...
Introduction to YARA Part 3 - Rule Use Cases8:55Introduction to YARA Part 3 - Rule Use Cases
Introduction to YARA Part 3 - Rule Use Cases
zhlédnutí 1,5KPřed 6 měsíci
In this OALABS Patreon tutorial we cover the three main use cases for YARA rules and how they apply to both BlueTeam/SOC operations and malware analysis. Fun notes have been unlocked for everyone on our Patreon here www.patreon.com/posts/introduction-to-96637668 The following are links to UnpacMe specific tutorials for developing each type of rule. Identifying specific malware families (unpacke...
Introduction to YARA Part 2 - Hunting on UnpacMe4:46Introduction to YARA Part 2 - Hunting on UnpacMe
Introduction to YARA Part 2 - Hunting on UnpacMe
zhlédnutí 1,7KPřed 6 měsíci
In this OALABS Patreon tutorial we demonstrate a simple YARA hunting example using the UnpacMe free YARA scan service: www.unpac.me Full notes have been unlocked on our Patreon here www.patreon.com/posts/introduction-to-96637337 OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON www.patreon.com/oalabs Twitch www.twitch.tv/oalabslive OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE U...
Introduction to YARA Part 1 - What is a YARA Rule9:50Introduction to YARA Part 1 - What is a YARA Rule
Introduction to YARA Part 1 - What is a YARA Rule
zhlédnutí 6KPřed 6 měsíci
In this OALABS Patreon tutorial we cover the basics of YARA, what is it, how is it used, and how to write your first rule. Full notes have been unlocked on our Patreon here www.patreon.com/posts/introduction-to-96636471 OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON www.patreon.com/oalabs Twitch www.twitch.tv/oalabslive OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING ...
Tips For Analyzing Delphi Binaries in IDA (Danabot)5:09Tips For Analyzing Delphi Binaries in IDA (Danabot)
Tips For Analyzing Delphi Binaries in IDA (Danabot)
zhlédnutí 3,5KPřed 7 měsíci
Reverse Engineering Delphi is a nightmare ... or it can be if you don't have the right setup! In this clip we cover some easy tips that can help make some of the analysis a bit easier. Full notes with links for tools are available here: research.openanalysis.net/danabot/loader/delphi/2023/12/04/danabot.html Full stream with analysis of the Danabot loader is available on Patreon here: www.patreo...
How To Recognize Macro Encrypted Strings in Malware9:14How To Recognize Macro Encrypted Strings in Malware
How To Recognize Macro Encrypted Strings in Malware
zhlédnutí 3,8KPřed 7 měsíci
How to identify when a macro is used to encrypt strings in malware... inferring source from disassembly! OALABS PATREON www.patreon.com/oalabs OALABS DISCORD discord.gg/6h5Bh5AMDU Twitch www.twitch.tv/oalabslive OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING www.unpac.me/#/
Direct vs. Indirect Syscalls What Is All The HYPE?! [OALABS Call-In Show]7:06Direct vs. Indirect Syscalls What Is All The HYPE?! [OALABS Call-In Show]
Direct vs. Indirect Syscalls What Is All The HYPE?! [OALABS Call-In Show]
zhlédnutí 3,3KPřed 9 měsíci
Our live discord call-in show debates! Are indirect syscalls even required? What are they and how are they used?! What are EDR vendors doing to detect them and why you might care.... OALABS PATREON www.patreon.com/oalabs OALABS DISCORD discord.gg/6h5Bh5AMDU Twitch www.twitch.tv/oalabslive OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING www.unpac.me/#/
Are Red Team Tools Helping or Hurting Our Industry? [OALABS Call-In Show]10:35Are Red Team Tools Helping or Hurting Our Industry? [OALABS Call-In Show]
Are Red Team Tools Helping or Hurting Our Industry? [OALABS Call-In Show]
zhlédnutí 1,9KPřed 9 měsíci
Our live discord call-in show debates! Are red team tools really helping our industry or are they just giving malware operators a free lunch?! OALABS PATREON www.patreon.com/oalabs OALABS DISCORD discord.gg/6h5Bh5AMDU Twitch www.twitch.tv/oalabslive OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING www.unpac.me/#/
Reverse Engineering With Unicorn Emulation21:03Reverse Engineering With Unicorn Emulation
Reverse Engineering With Unicorn Emulation
zhlédnutí 10KPřed 10 měsíci
In this OALABS Patreon tutorial we will learn how to use the Unicorn Emulator to assist with reverse engineering! This is the second part in a five-part tutorial series that can be found on our Patreon here... www.patreon.com/oalabs/posts?filters[tag]=Applied Emulation Lab Notes gist.github.com/herrcore/1a5af37f91a6f9b263a527c98c7b08bd OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON www.pat...
Emulation Fundamentals - Writing A Basic x86 Emulator26:53Emulation Fundamentals - Writing A Basic x86 Emulator
Emulation Fundamentals - Writing A Basic x86 Emulator
zhlédnutí 15KPřed 10 měsíci
In this OALABS Patreon tutorial we will explore how an emulator works by building one ourselves! This is the first part in a five-part tutorial series that can be found on our Patreon here... www.patreon.com/oalabs/posts?filters[tag]=Applied Emulation The demo Jupyter Lab note can be found on GitHub here... gist.github.com/herrcore/f25bcf55fa10fa8d04effc172eeb63c9 OALABS DISCORD discord.gg/6h5B...
AV Emulation Detection Tricks Used by Malware8:36AV Emulation Detection Tricks Used by Malware
AV Emulation Detection Tricks Used by Malware
zhlédnutí 6KPřed rokem
Tricks that malware developers use to detect antivirus emulators and how these differ from the sandbox emulators we use from our recent Twitch stream. Alexie's Windows Defender research with some insights into the emulation engine used... recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Reverse-Engineering-Windows-Defender-s-JavaScript-Engine.pdf i.blackhat.com/us-18/Thu-August-9/us-18-Bu...
Tips to Learn Reverse Engineering: Avoid These Common Pitfalls!9:11Tips to Learn Reverse Engineering: Avoid These Common Pitfalls!
Tips to Learn Reverse Engineering: Avoid These Common Pitfalls!
zhlédnutí 12KPřed rokem
How to maximize the return on your time when learning how to reverse engineer! Just a few thoughts on what worked for me and what to avoid from our recent Twitch stream. OALABS PATREON www.patreon.com/oalabs OALABS DISCORD discord.gg/6h5Bh5AMDU Twitch www.twitch.tv/oalabslive OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING www.unpac.me/#/
Understanding The PEB for Reverse Engineers16:09Understanding The PEB for Reverse Engineers
Understanding The PEB for Reverse Engineers
zhlédnutí 9KPřed rokem
Understanding The PEB for Reverse Engineers
Well it finally happened... infected myself with Emotet lel9:40Well it finally happened... infected myself with Emotet lel
Well it finally happened... infected myself with Emotet lel
zhlédnutí 7KPřed rokem
Well it finally happened... infected myself with Emotet lel
ESXiArgs Ransomware Analysis with @fwosar57:30ESXiArgs Ransomware Analysis with @fwosar
ESXiArgs Ransomware Analysis with @fwosar
zhlédnutí 5KPřed rokem
ESXiArgs Ransomware Analysis with @fwosar
What The Security Industry Should Know About Reverse Engineering [ Reverse Engineering AMA ]12:11What The Security Industry Should Know About Reverse Engineering [ Reverse Engineering AMA ]
What The Security Industry Should Know About Reverse Engineering [ Reverse Engineering AMA ]
zhlédnutí 2,7KPřed rokem
What The Security Industry Should Know About Reverse Engineering [ Reverse Engineering AMA ]
Do Companies Actually Pay Ransomware [ Reverse Engineering AMA ]6:21Do Companies Actually Pay Ransomware [ Reverse Engineering AMA ]
Do Companies Actually Pay Ransomware [ Reverse Engineering AMA ]
zhlédnutí 1,6KPřed rokem
Do Companies Actually Pay Ransomware [ Reverse Engineering AMA ]
What is The Future of Reverse Engineering [ Reverse Engineering AMA ]6:40What is The Future of Reverse Engineering [ Reverse Engineering AMA ]
What is The Future of Reverse Engineering [ Reverse Engineering AMA ]
zhlédnutí 2,4KPřed rokem
What is The Future of Reverse Engineering [ Reverse Engineering AMA ]
One Trick To Level Up Your Reverse Engineering [ Reverse Engineering AMA ]10:52One Trick To Level Up Your Reverse Engineering [ Reverse Engineering AMA ]
One Trick To Level Up Your Reverse Engineering [ Reverse Engineering AMA ]
zhlédnutí 3,8KPřed rokem
One Trick To Level Up Your Reverse Engineering [ Reverse Engineering AMA ]
How To Identify Unknown Crypto Functions [ Reverse Engineering AMA ]10:33How To Identify Unknown Crypto Functions [ Reverse Engineering AMA ]
How To Identify Unknown Crypto Functions [ Reverse Engineering AMA ]
zhlédnutí 1,8KPřed rokem
How To Identify Unknown Crypto Functions [ Reverse Engineering AMA ]
Tips For Writing a .NET Static Config Extractor for Malware [ Reverse Engineering AMA ]4:33Tips For Writing a .NET Static Config Extractor for Malware [ Reverse Engineering AMA ]
Tips For Writing a .NET Static Config Extractor for Malware [ Reverse Engineering AMA ]
zhlédnutí 784Před rokem
Tips For Writing a .NET Static Config Extractor for Malware [ Reverse Engineering AMA ]
What Is The Most Interesting Malware From 2022 [ Reverse Engineering AMA ]12:53What Is The Most Interesting Malware From 2022 [ Reverse Engineering AMA ]
What Is The Most Interesting Malware From 2022 [ Reverse Engineering AMA ]
zhlédnutí 2,5KPřed rokem
What Is The Most Interesting Malware From 2022 [ Reverse Engineering AMA ]
Most Embarrassing Malware You Have Analyzed [ Reverse Engineering AMA ]8:02Most Embarrassing Malware You Have Analyzed [ Reverse Engineering AMA ]
Most Embarrassing Malware You Have Analyzed [ Reverse Engineering AMA ]
zhlédnutí 1,6KPřed rokem
Most Embarrassing Malware You Have Analyzed [ Reverse Engineering AMA ]
How to Switch Careers Into Reverse Engineering [ Reverse Engineering AMA ]7:39How to Switch Careers Into Reverse Engineering [ Reverse Engineering AMA ]
How to Switch Careers Into Reverse Engineering [ Reverse Engineering AMA ]
zhlédnutí 2,3KPřed rokem
How to Switch Careers Into Reverse Engineering [ Reverse Engineering AMA ]
Tips for Analysis of Large Complex Binaries [ Reverse Engineering AMA ]7:35Tips for Analysis of Large Complex Binaries [ Reverse Engineering AMA ]
Tips for Analysis of Large Complex Binaries [ Reverse Engineering AMA ]
zhlédnutí 1,6KPřed rokem
Tips for Analysis of Large Complex Binaries [ Reverse Engineering AMA ]
Does Big Cyber Pay Better Than Startups [ Reverse Engineering AMA ]4:34Does Big Cyber Pay Better Than Startups [ Reverse Engineering AMA ]
Does Big Cyber Pay Better Than Startups [ Reverse Engineering AMA ]
zhlédnutí 1,5KPřed rokem
Does Big Cyber Pay Better Than Startups [ Reverse Engineering AMA ]

Komentáře

  • @wavefront6
    @wavefront6 Před 7 dny

    Just had to analyze this sample in SANS FOR610 training. Very nice sample.

  • @domenicosorrentino1972
    @domenicosorrentino1972 Před 9 dny

    Hi, i'd like to see the rest of the videos, but patreon decline my payment. Is there another way? Or platform to see all video course? Thank you

    • @OALABS
      @OALABS Před 8 dny

      Declined your payment?! Sorry but Patreon is the only option 💔

  • @pedrobarthacking
    @pedrobarthacking Před 11 dny

    Amazing content! Please do more videos Reverse engineering context! thank you.

  • @mt000mp
    @mt000mp Před 13 dny

    is there an update to this?

    • @OALABS
      @OALABS Před 12 dny

      A few things have changed, VMware is now free, Windows 11 installs without the hacks, we stopped trying to support FLAREVM but the basics are pretty much the same

    • @mt000mp
      @mt000mp Před 12 dny

      @@OALABS do I still have to convert VHDX to VMDK?

    • @cyberxson8454
      @cyberxson8454 Před 10 dny

      @@mt000mp No, you don't have to if you are downloading Win11 directly from VMWare Fusion

  • @q7b663
    @q7b663 Před 13 dny

    how would you go about finding the ioctl code if it wasn't pre-disclosed? i'm new to reversing

    • @OALABS
      @OALABS Před 12 dny

      7:35 pseudocode is pretty readable : )

  • @M3STERL3G3ND
    @M3STERL3G3ND Před 15 dny

    Excellent for beginners like me.

  • @Proferk
    @Proferk Před 16 dny

    2:49 could you link that tool? I couldn't find it anywhere. Perhaps I'm using the wrong search terms.

    • @OALABS
      @OALABS Před 14 dny

      Already linked in the article in the vid description

    • @Proferk
      @Proferk Před 14 dny

      No I mean the one you said by rattle, not the danabot scripts repo on GitHub

  • @alexandresantosal
    @alexandresantosal Před 20 dny

    Parabéns pelo conteúdo...

    • @OALABS
      @OALABS Před 19 dny

      chave de braço! 🇧🇷

  • @wittingsun7856
    @wittingsun7856 Před 24 dny

    Couldn't you have inserted a jump instead of the push 0?

  • @rackets0333
    @rackets0333 Před 26 dny

    I love you for uploading this. Great video!

  • @distortions
    @distortions Před 28 dny

    G-UINT

  • @MrChrisRP
    @MrChrisRP Před měsícem

    You know what I said to self? "That's nasty. Maybe I'll try that." I don't have a particular use for it and don't ever look at pseudocode for anything, ever. But still I dig it. Rock on, dude.

  • @_____666______
    @_____666______ Před měsícem

    so anyway to bypass breakpoint check ?

    • @OALABS
      @OALABS Před měsícem

      Turn it off on x64dbg?

  • @close7029
    @close7029 Před měsícem

    Dc ?

  • @Xereniak
    @Xereniak Před měsícem

    The Stompin' Tom outro really caught me off guard xD Unfortunately I seem to be at this kind of video a bit too early, don't know nearly enough about assembly to make heads or tails of what i'm looking at. I just wanted to figure out why this (not malicious) program I have wasn't properly launching xD

  • @user-qo2xj8wf6f
    @user-qo2xj8wf6f Před měsícem

    I did not see actual diffing like side by side pseudocode comparison in IDA is it possible with BinDiff?

    • @OALABS
      @OALABS Před měsícem

      I don't know of any open source tool that does this for pseudocode

  • @ayobro2091
    @ayobro2091 Před měsícem

    hi, i love malware develpment & reverse engineering in windows, how can i start this two fields? please help me

  • @mylosovich24
    @mylosovich24 Před měsícem

    sending mental fist bumps

  • @sametsahin-eh3qj
    @sametsahin-eh3qj Před měsícem

    not to be a dick but those edits ruins the video a lot and its so annoying

    • @OALABS
      @OALABS Před měsícem

      tenor.com/view/swag-cat-mad-watch-this-swag-crash-lol-gif-20326813

  • @johndoe-kg8nv
    @johndoe-kg8nv Před měsícem

    Hello! Thank you for this! Has anyone here run into the issue that after restart to Safe Boot, when logging on it says an app is need and one simply cannot log on?

  • @RickHenderson
    @RickHenderson Před měsícem

    I worked with an "experienced" coder who worked on Windows 95 and they've been calling it WindBag for years... because it's name is windbg - windbag. Pretty simple really.

    • @OALABS
      @OALABS Před měsícem

      None of this is true

  • @yongokpark5692
    @yongokpark5692 Před 2 měsíci

    Video very good 🎁🎁🎁😍😍 Like friends ❤❤❤❤❤⚘️⚘️🫰

  • @cuoreribelle4584
    @cuoreribelle4584 Před 2 měsíci

    hi, can you create a complete tutorial how to create a bortnet with IRC

  • @danielgarcia1484
    @danielgarcia1484 Před 2 měsíci

    I have a question, do you know why would a developer use this method? Is there any performance loss or anyother limitation because using the injection is lot more complex than just using the themida in the exe.

    • @OALABS
      @OALABS Před 2 měsíci

      honestly I think most of it is just boils down to skill issue, sadly

  • @danielgarcia1484
    @danielgarcia1484 Před 2 měsíci

    Bro thanks learn lot of tricks in your channel.

  • @julias-shed
    @julias-shed Před 2 měsíci

    I’ve been struggling with a Delphi file for the last week wish I’d found this sooner 😀

  • @alphabetadministrator
    @alphabetadministrator Před 2 měsíci

    Hi can I run Remnux on Flare VM for Windows on ARM?

  • @AlbertEinsteinGER
    @AlbertEinsteinGER Před 2 měsíci

    wow, a german!

  • @allurbase
    @allurbase Před 2 měsíci

    Nice to see mystery Sean, the hairy end of OALabs xD

    • @OALABS
      @OALABS Před 2 měsíci

      Lol clearly he got the hair for both of us XD

  • @mytechnotalent
    @mytechnotalent Před 2 měsíci

    pretty insane, thank you for this

  • @ethicalmath3963
    @ethicalmath3963 Před 2 měsíci

    a wild sean has appeared

    • @OALABS
      @OALABS Před 2 měsíci

      A rare sighting haha

    • @ethicalmath3963
      @ethicalmath3963 Před 2 měsíci

      @@OALABS let him out of the basement more often

  • @meshokhalil3689
    @meshokhalil3689 Před 2 měsíci

    احلي اصلع فالكوكب

  • @IlyaPopkov-bh9sp
    @IlyaPopkov-bh9sp Před 2 měsíci

    Can someone here invite me to Malpedia?

  • @bokaeimlinedancestudio7465
    @bokaeimlinedancestudio7465 Před 2 měsíci

    Thank you for your great work 👍 👏 😀 🙌 🙏 and for sharing ♥️ ❤️ ✨️ 😀

  • @s187v
    @s187v Před 3 měsíci

    awesome video

  • @MrSurfing4ever
    @MrSurfing4ever Před 3 měsíci

    Woooa, very CLEAR !!! thank you so much !!!!!!!!!!!1

  • @RashadIshmal
    @RashadIshmal Před 3 měsíci

    Thanks for the video. I have one question. My EntryPoint in x64dbg is 1001149B and PEbear lists 10E20 as my Function RVA for Export 'DllInstall'. How exactly would I add those numbers to set a BP after the call?

  • @yongokpark5692
    @yongokpark5692 Před 3 měsíci

    Video very good🎁🎁🎁🎁⚘️🌷 Happy birthday ❤❤❤🥰🥰🥰🥰❤️

  • @subxi5744
    @subxi5744 Před 3 měsíci

    I understand that it's a good practice to use WIN7 for RE, but these days some malware is targeting specifically WIN10 and nothing else. Have you found a reliable way to disable ASLR on Windows 10?

    • @OALABS
      @OALABS Před 3 měsíci

      This video is from 2019, as you point out prob not good practice to use win7 now haha. It's built into x64dbg now though i.imgur.com/hddLhub.png

    • @subxi5744
      @subxi5744 Před 3 měsíci

      @@OALABS 1. You're content is incredible - best RE/InfoSec channel ever. Thanks to you, I've been able to expand my skills beyond what I ever thought possible. 2. Thank you for spending the time to reply. You've saved me tons of headache.

  • @guilhermesaraiva3846
    @guilhermesaraiva3846 Před 4 měsíci

    you can recommended any book about emulation I am writing my article for my graduate program in computer science and I want to discuss emulation techniques and case study with analysis of how the JVM works, thanks

  • @Marstighter
    @Marstighter Před 4 měsíci

    very cool explanation. Nice talk about the API hammering. I also love the doggo[.]exe :)

  • @RobertoSantos-ne4us
    @RobertoSantos-ne4us Před 4 měsíci

    How do I debug Comodo Internet Security Pro? it reaches this breakpoint and no longer debugs.

  • @retrojames4226
    @retrojames4226 Před 4 měsíci

    The new WinDbg allows you to do kernel mode debugging from the host :)

  • @hax0rous
    @hax0rous Před 4 měsíci

    Thank you

  • @justlaz1444
    @justlaz1444 Před 4 měsíci

    idk when I press F5 it says sorry you don't have any decompilers on windows

  • @skycracker2462
    @skycracker2462 Před 4 měsíci

    Asking this more than a year after this video's release .... is this the best and most optimal way to build a Windows Malware Analysis environment on ARM Macs ?

    • @OALABS
      @OALABS Před 4 měsíci

      Still the setup that I use to this day 👍 Some of the quirks of the vm install have been ironed out as the hypervisor market catches up with the M series chips but overall this is the solution

  • @zxborg9681
    @zxborg9681 Před 4 měsíci

    Very cool. I'm writing an 8 bit multi-CPU symbolic simulator with static analysis and code tracing/debug capabilities, it's cool to see how the main OS's implement the debug/single step functions. Thanks for the explanation.

  • @markmanning2921
    @markmanning2921 Před 4 měsíci

    You spend a great edeal of time explaining what you are not going to be explaining instead of explaining all thye things you ARE going to be explaining.

    • @OALABS
      @OALABS Před 4 měsíci

      This would have been very helpful advice 6 years ago!

  • @user-wq1vm8gq6p
    @user-wq1vm8gq6p Před 5 měsíci

    May I ask if you have tried to compile unicorn from source? I tried to compile unicorn static libraries for arm64 architecture and failed.

    • @OALABS
      @OALABS Před 5 měsíci

      i.imgur.com/IhWEb3a.png

    • @user-wq1vm8gq6p
      @user-wq1vm8gq6p Před 5 měsíci

      @@OALABS wow,I didn't expect you to really answer my question. Thank you very much.

    • @user-wq1vm8gq6p
      @user-wq1vm8gq6p Před 5 měsíci

      @@OALABS 🤣man,It turned out to be a picture

    • @OALABS
      @OALABS Před 5 měsíci

      hahahah!! sry, yes I have compiled it, only pain awaits you...

  • @Robertorossell
    @Robertorossell Před 5 měsíci

    Thank! awesome video

    • @OALABS
      @OALABS Před 5 měsíci

      Thanks : ))