This course covers advanced techniques in malware analysis, including deobfuscation, reversing, and decrypting various types of malware such as AgentTesla, CryptoCrazy Ransomware, Lokibot, and REvil Ransomware. Students will learn skills such as using tools like SmartAssembly 8+, DnSpy, Powershell, and Fast API resolving. The teaching method involves practical demonstrations and hands-on exercises. This course is intended for cybersecurity professionals, malware analysts, and individuals interested in learning advanced malware analysis techniques.
Overview
Syllabus
Deobfuscation SmartAssembly 8+ and recreating Original Module SAE+DnSpy.
Advanced DnSpy tricks in .NET reversing - Tracing, Breaking, dealing with VMProtect.
Full malware analysis Work-Flow of AgentTesla Malware.
Powershell and DnSpy tricks in .NET reversing – AgentTesla [Part2].
Powershell and DnSpy tricks in .NET reversing – AgentTesla [Part1].
Reversing CryptoCrazy Ransomware - PoC Decryptor and some Tricks.
[2] Lokibot analyzing - spoofing GULoader and LokiBot C2 [part2] - INetSim + BurpSuite.
Fast API resolving of REvil Ransomware related to Kaseya attack.
[2] Lokibot analyzing - spoofing GULoader and LokiBot C2 [part1] - Own implementation in Python.
[1] Lokibot analyzing - defeating GuLoader with Windbg (Kernel debugging) and Live C2.
Visible vs Hidden vs VeryHidden Sheet - Excel Binary File Format (.xls).
Abusing External Resource References MSOffice [part1] - TEMPLATE_INJECTION.
Abusing External Resource References MSOffice [part2] - OLEOBJECT_INJECTION.
Taught by
DuMp-GuY TrIcKsTeR
