Bypassing BlackMatter Anti-Debug With x64dbg [Patreon Unlocked]

In this tutorial we demonstrate how to bypass the anti-debug checks in BlackMatter ransomware with x64dbg. Expand for more...
-----
OALABS DISCORD
/ discord
OALABS PATREON
/ oalabs
OALABS GITHUB
github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
www.unpac.me/#/
-----
BlackMatter sample:
malshare.com/s...

[@robbie2044]

Excellent video. A tip for those who want to "automate" the skip so you don't have to change the IP every time. Check the function out and if it is just calling NtSetInformationThread or some other anti-debug code and it doesn't contain important malware code (which it usually doesn't since it is isolated anti-debug function) you can simply NOP the whole call and skip over that check every time you restart the exe\dll in the debugger.

[@OALABS]

Nice tip!

[@sylvesterangiho9146]

Pls I want to learn software how can you help me please

[@az2252]

I never thought about using graph view while using x64 lol As always, your vids are the best.

[@OALABS]

Thanks! Sometimes it's very useful to see see the control flow from another perspective.

[@surajsawant6469]

this is amazing... nice work. thanks for sharing.

[@pedrobarthacking]

Amazing content! Please do more videos Reverse engineering context! thank you.

[@mytechnotalent]

Brilliant as always!

[@qweoiwjewiodc1954]

Excellent video

[@Axcmotora]

Thank you for this Good turtorial :)

[@hannahprobably5765]

features ! love them all 🚩❤

[@_why_3881]

What would be the approach when the exe reproduces itself and its threads (like in process explore you can see 6times the same process)

[@OALABS]

That's a completely different topic ;) You may want to check out some of our process injection unpacking tutorials.

[@lucasjulianlacognata6670]

Thanks Teacher, have you considered writing a book about reversing?

[@OALABS]

No books, just live workshops and videos : )

[@wittingsun7856]

Couldn't you have inserted a jump instead of the push 0?

[@dmitriydibenko5529]

Almost the same trick, as Enigma does to detach from the debugger. However, if I remember correctly, Enigma uses ZwSetInformationThread instead

[@sylvesterangiho9146]

Hi please help me crack my software

[@dmitriydibenko5529]

May I ask you to make a video about Software Nanomites?)

[@OALABS]

No, lol

[@AbacateSexy]

Thanks for making these videos free, I love them! Have u considered making a video analyzing the ransomware as a whole? D:

[@OALABS]

That's actually next up ... we have been laying the groundwork with the last few tutorials ;)

[@AbacateSexy]

@@OALABS Patreon only or u gonna make it public? :c

[@OALABS]

Live stream was recorded: kzbin.info/www/bejne/Zl7Tp5euqaiqnKc

[@AbacateSexy]

​@@OALABS you are amazing!

[@SilentGaming-SG]

Can this method remove the x63dbg (32bit) virus???

[@Sezdik]

hello, is there someone sleeping while you record? there is background voice.. like snoring ... just sayn

[@OALABS]

Haha that's my bulldog Boris. If you check out our streams on Twitch you will see he sleeps beside my desk and has his own doggo cam

[@atoma8921]

Where is the part II?

[@OALABS]

On our Patreon : ) www.patreon.com/posts/analyzing-anti-57443723

[@nonskeetuser760]

I think i want to marry this man