AhmedS Kasmani
AhmedS Kasmani
  • 35
  • 64 620
Malware 101: Injection Basics - Remote Shellcode Injection
This is a continuation of the series where I will share the basics of Malware.
In this video we discuss one of the many ways for a process to inject shellcode into another process.
Offensive Development Course: ask-academy.live/courses/offensive-development-and-tradecraft/
Code: discord.gg/SpdTFCAAzG
Please provide feedback in the comments.
To continue the conversation hit me up on twitter:
🐦 Twitter - nu11charb
zhlédnutí: 751

Video

Malware 101: Injection Basics - Local Shellcode Injection9:21Malware 101: Injection Basics - Local Shellcode Injection
Malware 101: Injection Basics - Local Shellcode Injection
zhlédnutí 705Před měsícem
This is a continuation of the series where I will share the basics of Malware. In this video we discuss a couple of simple ways for a process to inject shellcode into its process. Offensive Development Course: ask-academy.live/courses/offensive-development-and-tradecraft/ Code: discord.gg/SpdTFCAAzG Please provide feedback in the comments. To continue the conversation hit me up on twitter: 🐦 Tw...
Malware 101: Injection Basics - Dll Injection11:09Malware 101: Injection Basics - Dll Injection
Malware 101: Injection Basics - Dll Injection
zhlédnutí 609Před měsícem
In this video we continue our journey in the world of Malware. This is a continuation of the series where I will share the basics of Malware. Here we discuss Dll Injection, this is a very important technique to understand as it forms the basics of Process Injection. This is also important to understand for Api Hooking. Offensive Development Course: ask-academy.live/courses/offensive-development...
Malware Evasion 101: Detecting Debugger and Analysis Software10:22Malware Evasion 101: Detecting Debugger and Analysis Software
Malware Evasion 101: Detecting Debugger and Analysis Software
zhlédnutí 298Před měsícem
In this video we continue our journey in the world of Malware. This is a continuation of the series where I will share the basics of Malware. Offensive Development Course: ask-academy.live/courses/offensive-development-and-tradecraft/ Code: discord.gg/SpdTFCAAzG Please provide feedback in the comments. To continue the conversation hit me up on twitter: 🐦 Twitter - nu11charb
Malware 101: Writing your first Exe and Dll in C17:41Malware 101: Writing your first Exe and Dll in C
Malware 101: Writing your first Exe and Dll in C
zhlédnutí 1,7KPřed měsícem
In this video we dive into the world of Malware. This will be a series where I will share the basics of Malware. Offensive Development Course: ask-academy.live/courses/offensive-development-and-tradecraft/ Basics of PE File: learn.microsoft.com/en-us/windows/win32/debug/pe-format Code: discord.gg/SpdTFCAAzG Please provide feedback in the comments. To continue the conversation hit me up on twitt...
Latrodectus - Malware Analysis Part 234:06Latrodectus - Malware Analysis Part 2
Latrodectus - Malware Analysis Part 2
zhlédnutí 537Před 2 měsíci
This is part 2 of the analysis of the Latrodectus Malware. In this video we will look at the final payload. Final Payload Download Link: hxxps[://]bazaar[.]abuse[.]ch/sample/d843d0016164e7ee6f56e65683985981fb14093ed79fde8e664b308a43ff4e79/ Code Repo: github.com/nullcharb/LatrodectusYT Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: ask-academy.live/ Please p...
Latrodectus - Malware Analysis Part 18:37Latrodectus - Malware Analysis Part 1
Latrodectus - Malware Analysis Part 1
zhlédnutí 948Před 2 měsíci
In this part 1/2 we will be doing analysis of Latrodectus Malware. Stage1: Javascript Download Link: hxxps[://]bazaar[.]abuse[.]ch/sample/4ff60df7d165862e652f73752eb98cf92202a2d748b055ff1f99d4172fa4c92f/ Stage3: Msi File Download Link: hxxps[://]bazaar[.]abuse[.]ch/sample/3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f Course Link: courses.null-char.com/courses/the-art-of-malwa...
Introducing new course "Offensive Development and Tradecraft"5:11Introducing new course "Offensive Development and Tradecraft"
Introducing new course "Offensive Development and Tradecraft"
zhlédnutí 296Před 4 měsíci
Hey Friends, In this video I am introducing my new course "Offensive Development and Tradecraft" The course website: ask-academy.live/courses/offensive-development-and-tradecraft/ Please provide feedback in the comments. To continue the conversation hit me up on twitter: 🐦 Personal Twitter - nu11charb 🐦 Academy Twitter - askacademylive
Shellcode Loader Analysis and Python3 Scripting in Ghidra26:39Shellcode Loader Analysis and Python3 Scripting in Ghidra
Shellcode Loader Analysis and Python3 Scripting in Ghidra
zhlédnutí 497Před 7 měsíci
In this video I share how use Python3 Scripting in Ghidra to scripts for Shellcode loader Analysis and Shellcode Extraction. Links to the Github Repo for the code: github.com/nullcharb/GhidraScripting Link to the sample: hxxps[://]bazaar[.]abuse[.]ch/sample/733be2c75022f979e6568281e76da5fd3c709ddac41a3e644f0ff88432c5d248/ This is a must watch video for people interested in Malware Analysis, Sec...
Ghidra UI Updates for Malware Analysis and Introduction to python3 scripting in Ghidra14:05Ghidra UI Updates for Malware Analysis and Introduction to python3 scripting in Ghidra
Ghidra UI Updates for Malware Analysis and Introduction to python3 scripting in Ghidra
zhlédnutí 320Před 8 měsíci
We continue our series of Ghidra basics; in this video I share how I improve the UI to make it better for Malware Analysis and introduction to python3 scripting in Ghidra via Ghidrathon. Matthews Article: embee-research.ghost.io/understanding-and-improving-ghidra-ui-for-malware-analysis/ Ghidra Scripting Repo: github.com/nullcharb/GhidraScripting This is a must watch video for people interested...
Malware Analysis Lab Basics - Part 2 - Installing Ghidra14:23Malware Analysis Lab Basics - Part 2 - Installing Ghidra
Malware Analysis Lab Basics - Part 2 - Installing Ghidra
zhlédnutí 986Před 8 měsíci
We continue our series of Malware Analysis Lab basics; in this video I share how I install and configure Ghidra. Ghidra Link: ghidra-sre.org/ Ghidra Dark Theme: github.com/huettenhain/ghidradark Ghidrathon: github.com/mandiant/Ghidrathon Gradle: gradle.org/releases/ This is a must watch video for people interested in Malware Analysis, Security Operations and Security Analyst roles. Course Link:...
Malware Analysis Lab Basics - Part 1 - Installing Flare VM15:24Malware Analysis Lab Basics - Part 1 - Installing Flare VM
Malware Analysis Lab Basics - Part 1 - Installing Flare VM
zhlédnutí 3,3KPřed 8 měsíci
We continue our series of Cyber Security Lab basics; in this video I share how I install and configure FlareVM. FlareVM Github Link: github.com/mandiant/flare-vm This is a must watch video for people interested in Malware Analysis, Security Operations and Security Analyst roles. Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: ask-academy.live/ Please provide...
Cyber Security Lab Basics - Installing EDR in Malware Development Lab23:07Cyber Security Lab Basics - Installing EDR in Malware Development Lab
Cyber Security Lab Basics - Installing EDR in Malware Development Lab
zhlédnutí 2,4KPřed 9 měsíci
In the previous video I showed how to setup Malware Development Lab. In this video we add Elastic EDR to the lab. This is a must watch video for people interested in Security Analyst, Security Engineer, SOC Analyst roles. Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: ask-academy.live/ Please provide feedback in the comments. To continue the conversation hi...
Cyber Security Lab Basics - Setting up Malware Development Lab37:37Cyber Security Lab Basics - Setting up Malware Development Lab
Cyber Security Lab Basics - Setting up Malware Development Lab
zhlédnutí 1,2KPřed 9 měsíci
In this video, I walk through how I setup a Malware Development Lab. This is a very basic Lab where I use Kali linux for compiling code and Windows 10 for debugging and testing the code. This kind of a lab can be the building block for a very comprehensive lab for testing EDR and Security Solutions. Source code link: github.com/nullcharb/MalwareDevelopmentLab-YT Kali Linux Setup commands: sudo ...
NjRat Malware Analysis22:42NjRat Malware Analysis
NjRat Malware Analysis
zhlédnutí 4,5KPřed 10 měsíci
In this video we will be doing analysis of NjRat Malware. This is a beginner level video for people starting off in malware analysis. Malware Download Link: hxxps[://]bazaar[.]abuse[.]ch/sample/b02c3cc8be9da55c745c60521c8dc3d2c0a1494cfc8127b6785b58496a779383/ Dnspyex: community.chocolatey.org/packages/dnspyex Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: a...
Vidar Stealer Malware Analysis42:57Vidar Stealer Malware Analysis
Vidar Stealer Malware Analysis
zhlédnutí 4,2KPřed rokem
Vidar Stealer Malware Analysis
Racoon Stealer V2 Malware Analysis38:55Racoon Stealer V2 Malware Analysis
Racoon Stealer V2 Malware Analysis
zhlédnutí 4,5KPřed rokem
Racoon Stealer V2 Malware Analysis
Qakbot Dropper Analysis15:23Qakbot Dropper Analysis
Qakbot Dropper Analysis
zhlédnutí 4,5KPřed 2 lety
Qakbot Dropper Analysis
Zloader Malware Analysis - 1. Unpacking First stage.25:44Zloader Malware Analysis - 1. Unpacking First stage.
Zloader Malware Analysis - 1. Unpacking First stage.
zhlédnutí 1,6KPřed 2 lety
Zloader Malware Analysis - 1. Unpacking First stage.
Malware Analysis of Hancitor maldoc and initial Dlls37:28Malware Analysis of Hancitor maldoc and initial Dlls
Malware Analysis of Hancitor maldoc and initial Dlls
zhlédnutí 1,9KPřed 2 lety
Malware Analysis of Hancitor maldoc and initial Dlls
Analysis of Malware from Kaseya/Revil Supply Chain attack.36:55Analysis of Malware from Kaseya/Revil Supply Chain attack.
Analysis of Malware from Kaseya/Revil Supply Chain attack.
zhlédnutí 1,9KPřed 3 lety
Analysis of Malware from Kaseya/Revil Supply Chain attack.
Analysis of AppleJeus Malware by Lazarus Group32:47Analysis of AppleJeus Malware by Lazarus Group
Analysis of AppleJeus Malware by Lazarus Group
zhlédnutí 1,3KPřed 3 lety
Analysis of AppleJeus Malware by Lazarus Group
Analysis of malware dropped by Nobelium.24:42Analysis of malware dropped by Nobelium.
Analysis of malware dropped by Nobelium.
zhlédnutí 2KPřed 3 lety
Analysis of malware dropped by Nobelium.
Malware Analysis: Agent Tesla Part 2/2 Final Payload Analysis30:55Malware Analysis: Agent Tesla Part 2/2 Final Payload Analysis
Malware Analysis: Agent Tesla Part 2/2 Final Payload Analysis
zhlédnutí 1,5KPřed 3 lety
Malware Analysis: Agent Tesla Part 2/2 Final Payload Analysis
Analysis of ICEID Malware Installer DLL39:45Analysis of ICEID Malware Installer DLL
Analysis of ICEID Malware Installer DLL
zhlédnutí 1,8KPřed 3 lety
Analysis of ICEID Malware Installer DLL
Malware Analysis: Agent Tesla Part 1/2 Extraction of final payload from dropper.16:06Malware Analysis: Agent Tesla Part 1/2 Extraction of final payload from dropper.
Malware Analysis: Agent Tesla Part 1/2 Extraction of final payload from dropper.
zhlédnutí 2,5KPřed 3 lety
Malware Analysis: Agent Tesla Part 1/2 Extraction of final payload from dropper.
Extract Comrat Malware Dll's from Powershell Dropper14:22Extract Comrat Malware Dll's from Powershell Dropper
Extract Comrat Malware Dll's from Powershell Dropper
zhlédnutí 775Před 3 lety
Extract Comrat Malware Dll's from Powershell Dropper
Malware Analysis: VBScript dropper for NJRat.15:56Malware Analysis: VBScript dropper for NJRat.
Malware Analysis: VBScript dropper for NJRat.
zhlédnutí 1,2KPřed 3 lety
Malware Analysis: VBScript dropper for NJRat.
Malware Analysis of a Password Stealer29:35Malware Analysis of a Password Stealer
Malware Analysis of a Password Stealer
zhlédnutí 2KPřed 3 lety
Malware Analysis of a Password Stealer
1- Click Malware Analysis: IcedID JS Dropper3:441- Click Malware Analysis: IcedID JS Dropper
1- Click Malware Analysis: IcedID JS Dropper
zhlédnutí 682Před 3 lety
1- Click Malware Analysis: IcedID JS Dropper

Komentáře

  • @firosiam7786
    @firosiam7786 Před 11 dny

    I have a 2 3 doubts sir once u chaged the name tp payload to the demon x64 bin in all places there was already some shell stored in the tp payload variable right so does that get overwriten by the payload inside the demon x64 bin. Also the whole paters of creating memmory space writing payload to it then later executing the thread wont all be beacons in itself for any av solutions can threadless injection be done to maybe a process and execution be done through some Nt function ???

  • @firosiam7786
    @firosiam7786 Před 15 dny

    What is the best way to obfuscate shellcodes i know most would get flagged but just asking to knw some best ways to obfuscate shellcode

  • @AlienCode-ss
    @AlienCode-ss Před 23 dny

    Great series! It will be a valuable resource for new malware developer learners. As you suggested in one of the comments, prerequisites like learning X64Dbg and Windbg are important. Could you suggest some good online learning materials on these topics? Additionally, could you please create a video from a new learner’s perspective, (or might be this is first video showing a trailer for a larger series).

  • @alexhichamk6630
    @alexhichamk6630 Před 29 dny

    great video sir all the best we are waiting more videos

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Před 29 dny

    awsome video sir the quality of content is top notch

  • @user-uj4nq6gq5p
    @user-uj4nq6gq5p Před měsícem

    i was playing hamster kombat and my vpn get me this malware notificition and wont let me open hamster kombat , do they have it ?? :/:/

  • @disrael2101
    @disrael2101 Před měsícem

    thanks but im not a windows fan can you make it for mac / ios / android?

  • @ranger5280
    @ranger5280 Před měsícem

    Hello Ahmed, you said in the video that you have have your GitHub links to the source code in the video description, I do not see it. Could you please post it so we can review the code? Thanks

    • @ahmedskasmani
      @ahmedskasmani Před měsícem

      I am setting up a discord server where I will provide the code and answer questions related to the codes as well. Should be done this week.

    • @ranger5280
      @ranger5280 Před 29 dny

      @@ahmedskasmani Sounds good; looking forward to joining

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Před měsícem

    could u please launch a course in udemy also for malware dev as itll be kind of cheaper and available for a many people who cant afford the 100's of dollars worth course

    • @ahmedskasmani
      @ahmedskasmani Před měsícem

      Let me think about it.

    • @user-wp5en1lt8r
      @user-wp5en1lt8r Před měsícem

      @@ahmedskasmani im telling that from india we dont make that much money and udemy makes a regional price parity comapred to the GDP of the country you are in many more student can learn this if it would be like that thanks for considering it hope it does happen at some point in time

    • @disrael2101
      @disrael2101 Před měsícem

      @@ahmedskasmani +1 i'll buy it also but make it comprehensive for rev eng any app out there please

  • @chhachhiawan
    @chhachhiawan Před měsícem

    Kindly make a separate playlist for this series.

    • @ahmedskasmani
      @ahmedskasmani Před měsícem

      czcams.com/play/PLXlzLNcZf2-8RnKqZIYYetIuG7rnUmYz-.html

  • @oldgamerZone
    @oldgamerZone Před měsícem

    Great job man!

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Před měsícem

    now waiting for the next video in this series sir so far loving this series wish i could have joined the course you have on maldev but its way out of my budget so following along here next time could u do a mini malware dev course for Udemy as it will kind of ensure a GDP based pricing for people from different countries around the world

  • @alexhichamk6630
    @alexhichamk6630 Před měsícem

    Thank you sir, all the best

  • @kumaranshuman4227
    @kumaranshuman4227 Před měsícem

    Awesome video

  • @rastakitten
    @rastakitten Před měsícem

    Just a noob question: why would you add logging feature in your malware?

    • @ahmedskasmani
      @ahmedskasmani Před měsícem

      Good Question, so the way logging is implemented is such that if u want to debug something it can be done, and when ur releasing it u can disable the logging.

  • @imranthoufeeque165
    @imranthoufeeque165 Před měsícem

    Assalamualaikum... Kindly make a playlist of this please.

    • @rlynotabot
      @rlynotabot Před měsícem

      aleikumsalam, kindly make it yourself when he'll post the next ones ;)

    • @imranthoufeeque165
      @imranthoufeeque165 Před měsícem

      @@rlynotabot ha ha ha... I am ok to make if he gives me the creds 😂😂😂😂

    • @rlynotabot
      @rlynotabot Před měsícem

      @@imranthoufeeque165 lol you must be trolling right ? . The brother gives you free knowledge and all you have to do is clicking a button to create a youtube playlist and tou still want the creds ? You must be knew

    • @imranthoufeeque165
      @imranthoufeeque165 Před měsícem

      @@rlynotabot No bro i appreciate what he is doing... I am not sure if I can make a playlist of his content in his channel itself.. As per my knowledge they only have to create a playlist... If its not included under the playlist it will scattered..

    • @rlynotabot
      @rlynotabot Před měsícem

      @@imranthoufeeque165 Trust me bro you can do it ! lol . Go to the watch page of a video that you want in your playlist. Below the video, tap Save . Tap Create new playlist . Enter a playlist name. Use the box to select your playlist's privacy setting. If it's private, only you can view the playlist. Tap CREATE. I created countless playlist like that, Malware, Cheats, reverse enginering, HArdware hacking , SDR etc...

  • @elliot-hacks
    @elliot-hacks Před měsícem

    Impressive demonstration 🙏, I'm always excited with malwares

  • @geeksuperstar8564
    @geeksuperstar8564 Před měsícem

    Great content. I wish you had playlists for your different topics to make it easier to follow them.

  • @aironmanDiver
    @aironmanDiver Před měsícem

    Hi ! From a point of view , it is fun to learn this techniques, but it exists a responsibility to tech the way to prevent and fix this malware

  • @alexhichamk6630
    @alexhichamk6630 Před měsícem

    Hell Mr Ahmed, Inchaa Allah you are in good health, thank you for these great videos can you please make an introduction video for the beginners in malware dev, like the languages we need to learn and so on Thank you very much

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Před měsícem

    greatfull for you to start this series, im from india and could not afford many courses out there which are worth 100s of dollars to learn mal dev hopefully this series continues in a timely manner and many people from different parts of the world could learn these techniques

  • @mohsinhafeez
    @mohsinhafeez Před měsícem

    thank you!

  • @lofi_spirit
    @lofi_spirit Před 2 měsíci

    sir, i am gettig this error : error : " [+] Setting password to never expire to avoid that a password expiration blocks the installation... Set-LocalUser : The term 'Set-LocalUser' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At D:\flare-vm-main\flare-vm-main\install.ps1:318 char:5 + Set-LocalUser -Name "${Env:UserName}" -PasswordNeverExpires $tru ... + ~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Set-LocalUser:String) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : CommandNotFoundException " AND also showing a warning that we are not running it in virtual machine so will it affect our system?

  • @zyadelzyat
    @zyadelzyat Před 2 měsíci

    great work ❤ may i ask if i want to make a script to resolve those hashes at once what can i do ?

  • @MalwareHunter_07
    @MalwareHunter_07 Před 2 měsíci

    hey great explanation but i wanted to know whats the final payload dll have impact on the system? or just a sideloading

  • @arizvisa
    @arizvisa Před 2 měsíci

    setting operands to enum, and renaming frame members is something that you should also be scripting.

    • @ahmedskasmani
      @ahmedskasmani Před 2 měsíci

      Good point. I was being lazy about it :)

  • @bilalsiddiqui9341
    @bilalsiddiqui9341 Před 2 měsíci

    brilliant. i love how you make something so detailed, like reverse engineering/malware analysis, seem so straightforward and clear. hope to see more vids in the future until i can afford the course!

  • @MalwareHunter_07
    @MalwareHunter_07 Před 2 měsíci

    make one video on blackmatter & lockbit ransomware analysis

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Před 2 měsíci

    could you do a video on how someone could look for malware if he has doubt wether his system is infected or not

  • @mohamedlmad
    @mohamedlmad Před 2 měsíci

    goooood

  • @bhumiputra6108
    @bhumiputra6108 Před 2 měsíci

    Eagerly waiting for your next video

  • @Edison-newworldBlogspot
    @Edison-newworldBlogspot Před 2 měsíci

    Super analysis

  • @bilalsiddiqui9341
    @bilalsiddiqui9341 Před 2 měsíci

    awesome!

  • @babbalaminou5956
    @babbalaminou5956 Před 2 měsíci

    Great work

  • @MalwareHunter_07
    @MalwareHunter_07 Před 3 měsíci

    elastic search service stopping after a while? any solution

  • @MalwareHunter_07
    @MalwareHunter_07 Před 3 měsíci

    you have changed the ip address is it ubuntu ip right?

  • @R3v0ult
    @R3v0ult Před 3 měsíci

    brilliant video

  • @disrael2101
    @disrael2101 Před 4 měsíci

    great sounds amazing.. what about mac / linux / ios / android similar course? as i'm not a windows fan e.g. pegasus

  • @rizwanmehboob4725
    @rizwanmehboob4725 Před 4 měsíci

    Great work as always. The syllabus is indeed in-depth and full of advance topics. Note taking during a course is always painful and notion is looking promising. Thank you for sharing.

  • @moinkhokhar1897
    @moinkhokhar1897 Před 4 měsíci

    🎉🎉🎉🎉🎉🎉

  • @rafaellee711
    @rafaellee711 Před 5 měsíci

    Hi, is there a download link for agent tesla? :)

    • @ahmedskasmani
      @ahmedskasmani Před 5 měsíci

      The hashes are the description just search for the hashes on Malware Bazaar. Google/Bing is ur friend.

  • @system62_
    @system62_ Před 6 měsíci

    Thanks You sir

  • @WatsonInfosec
    @WatsonInfosec Před 6 měsíci

    Found this link on LinkedIn and enjoyed it. My only issue is that Elastic has not written code to generate Binary files for fleet agent installs. It's a really good product but no development on that side.

  • @kaiden3514
    @kaiden3514 Před 7 měsíci

    *promo sm* 🤩

  • @OrlandoF654
    @OrlandoF654 Před 7 měsíci

    Is the Ghidra installation and usage part of your course?

    • @ahmedskasmani
      @ahmedskasmani Před 7 měsíci

      Yes, all static analysis is done in ghidra.

  • @opmfa1850
    @opmfa1850 Před 7 měsíci

    how to activate dark mode in ghidra??

    • @ahmedskasmani
      @ahmedskasmani Před 7 měsíci

      my video shows how to do it: czcams.com/video/debaKMGM78E/video.htmlsi=AAKwG71ooDQSJ8wL

  • @shrooms1219
    @shrooms1219 Před 7 měsíci

    what is the hardware compatibility of your vmware? it is pretty slow on vmware17.0

    • @ahmedskasmani
      @ahmedskasmani Před 7 měsíci

      Make sure you disable side channel mitigations in the advanced settings in vm setting menu.