8 ай бұрын
10 ай бұрын
Пікірлер
@amirkazemi9164 35 минут бұрын
Nice video Is there any tools to Removing anti-reversing checks for dotnet? @MalwareAnalysisForHedgehogs thanks
@hb3643 11 күн бұрын
Hi Karsten, I know the Udemy course is way for you to get money and the content you are giving the public is priceless. Some people can not pay the price of the course, are you going to provide coupons oe at least have some discounts. More good karma what do you think?
@MalwareAnalysisForHedgehogs 11 күн бұрын
I do that regularly. Here is one 86E1081115312DC3AD07
@overlaw66 21 күн бұрын
Fantastic Video
@mohammedfouad-m9d 25 күн бұрын
great tutorial. i have a question: we i studied the book of "practical malware analysis" awhile ago i came across snort rules to catch network signature. the question is is this still relevant today or there is different strategy utilized these days?
@MalwareAnalysisForHedgehogs 25 күн бұрын
Yes, many companies use Snort. Additionally, security vendors often have their very own languages to describe detection algorithms or patterns and they have their own detection technologies that are not necessarily comparable to any of the open source solutions. They do not only focus on one but implement several at once. So there are many different strategies for detection technologies and detection rules.
@opmfa1850 26 күн бұрын
excellent as usual thanx a lot. danke :)
@micha7863 26 күн бұрын
As always, great content! Thanks
@mohsinhafeez 26 күн бұрын
thank you! hope to see more content from you related to yara :)
@MalwareAnalysisForHedgehogs 26 күн бұрын
Sure, what do you want to see?
@mohsinhafeez 25 күн бұрын
@ I’m trying to learn Yara, I would like to see how to run malware in a sandbox and then write signature to detect it.
@MalwareAnalysisForHedgehogs 25 күн бұрын
@@mohsinhafeez Thank you for the suggestion. What is the difference to the current video? Unpac.me is a sandbox that allows scanning with Yara.
@mohsinhafeez 24 күн бұрын
@@MalwareAnalysisForHedgehogs What I meant was, if you could do this with more malware and show how to work with Yara, that would be great :)
@MalwareAnalysisForHedgehogs 24 күн бұрын
@@mohsinhafeez Ah, I get it. Yeah, why not.
@AnuragGawande Ай бұрын
Awesome video. Thanks.
@kipchickensout Ай бұрын
-Gheidra- Gheedra
@gokulakrishnankrishnan808 Ай бұрын
Awesome work, useful and alternate way to try in x64dbg.
@FatimaAli39634 Ай бұрын
❤❤❤
@matthewbascom Ай бұрын
Thank you for sharing this interesting work!
@_____666______ Ай бұрын
after a longtime 🎉
@mohammedfouad-m9d 2 ай бұрын
if it is possible could you make a video on how to write a good malware analysis report in a professional way?
@mohammedfouad-m9d 2 ай бұрын
excellent tutorial sir.
@opmfa1850 2 ай бұрын
how can i debug (dynamic analysis) a .net dll file? in x32dbg we use rundll32.exe what can we use in dbspy??
@MalwareAnalysisForHedgehogs 2 ай бұрын
Load it from PowerShell terminal, then attach dnspy as debugger, then call the export you want to call from PowerShell terminal.
@opmfa1850 2 ай бұрын
@@MalwareAnalysisForHedgehogs so i attach dnspy to powershell process?
@MalwareAnalysisForHedgehogs 2 ай бұрын
@@opmfa1850 Yes. You can watch the last part here, where I am doing exactly that: kzbin.info/www/bejne/rX3JkH-kbc-oprssi=egD5PsCCLoxEdkye&t=1299
@opmfa1850 2 ай бұрын
@@MalwareAnalysisForHedgehogs yet another great tutorial. learned more tricks 🥰
@d3f4rm 2 ай бұрын
Incredibly helpful and very succint! Thanks Karsten.
@MalwareAnalysisForHedgehogs 2 ай бұрын
Thank you :)
@rioasmara82 2 ай бұрын
I used IDA. Now, I am using Binary Ninja
@VincentDegrave 2 ай бұрын
Nice video good tech skills on how to. Dank u wel!
@awesomesauce804 2 ай бұрын
@ 21:15 you want to Ctrl + alt + p and then change python interpreter to the version your pip is installing to. If that doesn't work just Ctrl + alt + p and type python and click restart interpreter.
@MalwareAnalysisForHedgehogs 2 ай бұрын
Hi, thanks, but I am not sure how this is supposed to help here. You cannot install dnlib with pip.
@awesomesauce804 2 ай бұрын
@@MalwareAnalysisForHedgehogs oh sorry haha I missed that it was dnlib -- I just have similar issues all the time. Sorry for the confusion. Great video I learned some things about working with the assemblies from powershell. Thanks for putting out quality content. I was particularly impressed with how well you write functions --- I am quite a lot slower and make more mistakes. Looking forward to seeing more videos!
@opmfa1850 3 ай бұрын
excellent as usual. thanx a lot
@novianindy887 3 ай бұрын
any malware dev course?
@MalwareAnalysisForHedgehogs 3 ай бұрын
No
@novianindy887 3 ай бұрын
u use c or c++ ?
@RazviOverflow 3 ай бұрын
Amazing content. Thank you :)
@ibraheemnada7541 3 ай бұрын
Writing malware can make you very wealthy person whereas finding a job as a security researcher in this IT market will lead to nowhere. ;)
@sachin-tr4nc 3 ай бұрын
Thanks for the Detail video Kristan sir, Really Informative video with Good Explanation, Appreciate your Hard work making these videos, Best wishes 😊
@Bars_Mutlu-qf4gj 3 ай бұрын
Brooo you are such a legend!!! please keep going! Respects from Germany
@ElvisLamAsia 3 ай бұрын
ordered right away
@shaggy6249 3 ай бұрын
Good video but hard to follow with the hand written notes
@MalwareAnalysisForHedgehogs 3 ай бұрын
You are right, thank you for the feedback, I will do better :)
@ValliNayagamChokkalingam 3 ай бұрын
Informative!
@idan4329 4 ай бұрын
I think most people use cr@cked ida on a virtual machine for home usage for work it's more problematic. ghidra has an aweful UI, but has some powerfull features for certain aspects.
@PrinterJamOnToast 4 ай бұрын
Thank you for the analysis. Next time could you link the sample of each stage please? Without VT enterprise I can't obtain the atom.xml payload as the site is offline and as it is executed in memory I don't see file artefacts in public sandbox reports, so can't follow along.
@MalwareAnalysisForHedgehogs 4 ай бұрын
Hey, thank you for the hint! I forgot to include it when publishing the video. I will update the description. Here is atom.xml malshare.com/sample.php?action=detail&hash=cb21368467bdf0ca8a4cd458f54d684e10da2d43a9c7285e094d39bdc410fb10
@yungdawwg7081 4 ай бұрын
hello, i have a question regarding the case of using new malware code which is essentially a zero day but packing it with a "tagged" stub, that will result with the file being detected as mw. My question then is it possible for a malware writer to know which stub is unused, or it's impossible since it depends on the packer which chooses randomly, then we are left with two options either there is a packer in the dark web used by hackers which removes a stub each time they sell it to a buyer. or the malware owner tries his packed file with multiple AVs many times until it's not detected ? sorry if i turned it into a monolog i just got lost speaking outloud.
@censoredeveryday3320 4 ай бұрын
Very informative video, thank you. When I'm not so poor, I will purchase your Udemy course.
@censoredeveryday3320 4 ай бұрын
@@MalwareAnalysisForHedgehogs Okay great. Thank you so much.
@MalwareAnalysisForHedgehogs 4 ай бұрын
@@censoredeveryday3320 Hey, this is not a means to get you to buy the course, use the coupon for access. For obvious reasons I won't keep it enabled much longer.
@censoredeveryday3320 4 ай бұрын
@@MalwareAnalysisForHedgehogs Thank you so much. I have copied down the code. I really appreciate it.
@censoredeveryday3320 4 ай бұрын
I had a dream that you were EMPRESS and that this is your voice. I won't go into any further details =]
@MalwareAnalysisForHedgehogs 4 ай бұрын
Oh wow, what a dream. X)
@bobo-px5gy 4 ай бұрын
Thanks man
@modWebGL 4 ай бұрын
For some reason I want to use the hex tool to edit the .net managed file(Because DNspy had some errors after recompiling files),Can you give a tutorial on how to edit .net file via hex tools? thanks
@MalwareAnalysisForHedgehogs 4 ай бұрын
Hi. I am not sure what you want to edit there and what the purpose is. I think a hex editor is rather inconvenient for most editing cases. There are libraries that can parse and edit files. Maybe try AsmResolver.
@modWebGL 4 ай бұрын
I want to edit a program that contains unmanaged code （Some managed programs and can also contain unmanaged code），But when I use the DNSPY to edit and save the project the project runs with errors ，So I want to understand how dnspy modify the hex bytes
@sachin-tr4nc 4 ай бұрын
Great information, Really good knowledge video, Thanks making this video.
@MalwareAnalysisForHedgehogs 4 ай бұрын
For unknown reasons the sync of the audio is off, but only after I upload a video to KZbin. When I watch the video from the local file, everything is fine. I have no idea why this happens. If anyone can give me a pointer, I would be open to hear it.
@modWebGL 4 ай бұрын
hello, I want to use the hex tool to edit the .net managed file(Because DNspy had some errors after recompiling files),Can you give a tutorial on how to edit .net file via hex tools? thanks
@caboseisstupid 4 ай бұрын
Playback is fine on my setup (casting from phone to a Chromecast plugged into our TV), if there's a desynch it's less than a tenth of a second but it's not noticeable on this side.
@yungdawwg7081 4 ай бұрын
hello i know this vid is pretty old but i hope you can provide some context for me; what did you mean by decrypted body shape when talking about the deference between oligo/poly/meta -morphic viruses ? is it referring to the dynamic behavior of the malware ?
@MalwareAnalysisForHedgehogs 4 ай бұрын
Hi. It refers to the main code of the malware that is hidden by encryption. It shall illustrate that metamorphic viruses change their own instructions with every new generation of the virus, whereas the main polymorphic virus code usually looks the same after unpacking.
@luandemattos1939 4 ай бұрын
Very well explained, it was a masterclass of writing your own unpacker, thanks for the video and explanations!
@MalwareAnalysisForHedgehogs 4 ай бұрын
Thank you :)
@andreasschommer5435 4 ай бұрын
Great stuff! I did not see any good tutorial on speakeasy so far. I learned a lot here. Thanks Karsten.
@MalwareAnalysisForHedgehogs 4 ай бұрын
Thank you! I also did not find any guides and the documentation is a bit lacking. Otherwise I would have tried scripting with it sooner. I needed to read the source code to figure out how to use it.
@debnathmriganka2010 4 ай бұрын
Helo Sir, Can you help me one thing Last few days I am trying reverse engineering for my one small exe file, I am new learner, but cant do it, because of that i am not getting OEP using x64dbg, thats why i cant do this. Please can you help to do reverse engineering for the exe file or make a video tutorial for that. Thank you sir.
@MalwareAnalysisForHedgehogs 4 ай бұрын
Is it malware? If yes, put it on malshare.com or malwarebazaar and post the link.
@debnathmriganka2010 4 ай бұрын
@@MalwareAnalysisForHedgehogs Hello Sir this is not malware, it is a windows applicaiton file, I am new learner. can you help me. If you need i can share with you with google drive.
@bohanzhang4364 4 ай бұрын
Looks like the JS tool extract_called_functions.js only supports the [email protected]. I tried the tool with the latest commander package and recevied an "version" not found error.
@MalwareAnalysisForHedgehogs 4 ай бұрын
Ah, that explains why some people had trouble setting it up. Thank you for the hint!
@awesomesauce804 4 ай бұрын
Whew. Pascal. That's something I haven't thought about since the late 90s.
@naimulislam1263 4 ай бұрын
I just use radare2 and cutter :3
@pwhittak88 4 ай бұрын
Just purchased your course, can't wait to get stuck in.
@Valli-NayagamChokkalingam 5 ай бұрын
Very Useful! Thanks!
@Ocean7653 5 ай бұрын
The handwritten text discouraged me from going in more than 2 minutes
@MalwareAnalysisForHedgehogs 5 ай бұрын
Thank you for your feedback. Yes, the presentation is not really good. This video is a few years old, I hope the current ones are a little better.
@javapaceable 5 ай бұрын
Ghidra support has been fairly constant since its release via github. Simple bugs and usability issues are usually fixed very quickly. Some of the more complex issues/requests eventually get fixed too, like the addition of theming.