Malware Analysis In 5+ Hours - Full Course - Learn Practical Malware Analysis!

[@huskyhacks]

Hey everyone, I messed up the editing for this release and two clips are out of order. The correct order for Parts I and II of Dynamic Analysis of an Unknown Binary should be as follows: 3:00:54 - Part 1 Basic Dynamic Analysis 2:39:37 - Part 2 Basic Dynamic Analysis I apologize for the confusion!

[@zizzixsec]

A side note for anyone who runs wannacry at the first detonation and nothing happens, Make sure you disable inetsim on the remnux box as the first thing wannacry does is reach out for a dns host and if it replies, it wont run. Thats how Marcus disabled it in the first place.

[@PlentyRude]

Thanks!

[@0xKilty]

Thank you for this

[@ily_alex1]

thank you so much, I've actually been stuck on this for some time, and it was like the first time in my life I was frustrated over a piece of malware that doesn't wanna run on my system

[@repairstudio4940]

Very helpful, thank you ❤

[@KenPryor]

I recently completed the full 9 hour course on TCM and loved it. Great class!

[@wiredogsec]

Thank you! I managed to pick up the full course (as well as others) during the $1-$6 discount event! You guys are awesome! I am halfway through PMAT and I am enjoying it. This is definitely worth the money! TCM Security has high quality and very affordable training.

[@khodorj6581]

Hello, i want to ask how can I drag and drop the malware folder from host to FlareVM, not able to perform this action

[@wiredogsec]

@@khodorj6581 I am using VMware Workstation and I had to install VMware tools. There is probably a similar process for VMware Player or VirtualBox.

[@talalsallmart1]

@@khodorj6581 in vm settings set them drag modes to bi directional

[@d4ddyn0n4me8]

Im about 60% through your course loving it gotta stalk your youtube for everything i need more.. MOOORE 👁️👄👁️ Would definetly recommend his course for anyone reading :D

[@somberrage4692]

Excellent resource. Certainly appreciate the effort that went into this! I encountered an issue with the Windows machine where it wouldn't be fed any fake html page after manually setting the DNS on the Windows machine for the Remnux host. The issue was with the LAN Settings Automatically Detect Settings configuration. Unchecking this box within Internet Explorer resolved the matter. Just in case anyone oberves this as well.

[@tannerjones1331]

Great course! I just made it through the tutorial! I was able to solidify my understanding on basic malware analysis. I have taken a course in my graduate studies and it was a great supplement.

[@ReMaX2013]

i just completed the course , i really want to thank you for sharing that for free

[@carenmorenmoren9156]

I don't usually comment on KZbin but you deserve admirations. I will make sure to mention you in every interview I have for Threat Intel position and to everyone who is interested in Threat Intel/Malware analysis career path. Thank you is not enough.

[@huskyhacks]

Hey fam! I just released a new, free section of PMAT that includes more detail about the security of Host Only networks and how to set up an Internal Network for malware analysis. It fits right in after the video at 51:39:00. Check it out here: notes.huskyhacks.dev/blog/malware-analysis-labs-internal-network-vs-host-only

[@hywellbutrotmg]

damn i knew you made long courses but 51 hours is insane

[@francesco2092]

this is why they say that teaching is an art... you can make someone who knows nothing understand things and slowly take them to the next level is spectacular... as soon as I finish these 5 hours I can't wait to go to buy the rest of the course.

[@repairstudio4940]

This has been such an amazing journey. Much respect to Husky! Heath's crew @ TCM are awesome! 🎉

[@spammers7431]

Just completed this course its soooo awsome

[@filippogiorgiorondo6932]

sorry but u desable windows updates and windows defender?

[@daredevil_orchid]

Man you are so generous. Now I can tell my Junior to learn from here to know if he's into malware analysis. Btw I already have the full course and I'm halfway done.

[@Manjith23]

@daredevil_orchid hieee

[@MehwishAli-w9i]

In remnux when i mount it said no medium found on dev/sro what i can do for these

[@gameblendingreality]

Go to devices>insert guest additions cd image... >run

[@skullhead8381]

@@gameblendingreality thanks i have been struggling with this for 3 days now i don't really know how to use linux so i am using virtualbox but whenever i install a live cd or ova no medium found occurs

[@logicbypass]

Some may have noticed that the part of Basic Dynamic Analysis was not mounted in the proper order. 3:00:54 - Part 1 Basic Dynamic Analysis 2:39:37 - Part 2 Basic Dynamic Analysis Thank you @huskyhacks531 for a fantastic tutorial

[@huskyhacks]

Yep, I just realized this. Thank you for pointing it out. I just looked into the editor to see if I could rearrange the order but it doesn't look like that's the case. I'll add something to the description and a pinned comment to try to clear up any confusion.

[@meyvesuyudunyasi]

really realley excellent course, thank you

[@scottcarey2483]

Glad I found this video. I'm getting in to malware analysis in my job and I think your course will be a great intro. Do you cover analysis of malicious websites too?

[@atikullah9066]

best malware analysis course. Thanks for this amazing course

[@firosiam7786]

Good to see you share this much for free to many people God bless you.

[@niless577]

It was an amazing and helpful tutorial for beginner malware analiyst. Thank you so much, I was searching something like this and your content is exactly what I was looking on the internet. Thank you again🤗

[@brandonevans5123]

I can't wait to watch this all the way through! Thank you!

[@rojjst]

You earned a sub, my friend 😊

[@mohsinhafeez]

I already have your course, but its good to see it on youtube :)

[@NickGalaftion]

Excellent intro to malware analysis ! great job ! looking fwd at many more videos ..

[@Hanacan75]

Thank you my friend. Excelent tutorial :) I'm cheering for you to do more. hhaha

[@D3ltaLabs]

How am I only finding your channel now.. great tutor. I'll slowly watch all your videos now.

[@julieuzii6350]

awesome video, thank you for all the information. I am a cybersecurity student and found this video invaluable.

[@libusengmengwai3215]

Thank you Matt, we truly appreciate the 🎁

[@philosphize]

Thank you so much for this amazing tutorial Please release next set of malware analysis video

[@youaregod2382]

Thank You for this. i actually finished your course,it was really awesome experience lots of good learning, Highly recommended your course. A very good teacher😍😇

[@rasperss_5176]

One tip, personally I would go the extra step and by ensuring clipboard sharing is disabled when deploying malware. I don't think he mentioned that and did notice he had it enabled when copying hashes to virus[.]total just my two cents. But great video none the less!

[@gameblendingreality]

It looks like Flare VM already defaults to disabling the clipboard

[@_Slaze]

Thank you for the awesome course

[@Lwyte17]

Im curious, has the FLAREVM installation changed? I went through the process but simply get a folder named Tools instead of FLARE. Also it seems the packages that get installed are different than those seen the video, for example no peview. Is that just necause theyve changed their tool lost in the config file?

[@rodrigopatino3382]

How to filter on Procmon: 2:27:00 3:28:42

[@_clavita]

I bought this and im so happy i did

[@todorokiyosukedesu]

Did you bought it on TCM Security?

[@_clavita]

@@todorokiyosukedesu yeah!

[@Manjith23]

hello

[@Manjith23]

@_clavita hello'

[@علاويالاسدي-ي3ض]

I can't thank you enough, Matt 🌸💝

[@BustinJustin951]

21:56 I get error "no medium found on /dev/sr0" :(

[@ricorobinson3954]

It means the needed files are already on your distro. Your good to go!

[@isuamalinato1803]

Hello, I’m stuck at the remnux phase where I’m supposed to mount a media It’s keeps telling me “/decdrom” does not exist I look forward to your assistance, thank you

[@JaspherSanchez-k5c]

me too stuck with remnux

[@nicksunny100]

Subscribed!!

[@Don01841]

Appreciate the effort you put in this video. Amazing content. What i liked about the video is the way it has been explain which clear and to the point. Thanks husky.

[@wendy_113]

I cannot thank you enough.

[@dendell8860]

Great Video..Thank you

[@nelsonnelson31]

Good Lecture man!

[@yaseerkadam9496]

You're the best bruh

[@TheTntwilliams]

Great video and was wondering if you have AV enabled when you run your samples on the VM or did you disable

[@RozzClips]

Thank you so much

[@Manavetri]

Brilliant !!!

[@GaryBales-q3n]

The vbox files on the cdrom exist but on Remnux the files do not exist in cdrom anywhere. I have watched the video up the the sudo mount segment 3x but not sure what to try differently. Thanks

[@hristinaivanova2238]

Hi, I have an issue with the inetsim. I have done everything correctly step by step but I only get the message about the fake mode when I navigate to the 10.0.0.3 remnux IP. When I try to run any other site I get 'this site can't be reached'. Can I have some help, please?

[@arturcorreia6615]

Windows Defender is not letting me detonate de virus :(

[@Fatima-u7r2w]

Thank you so much for all your hard working ,but I do not know why the commands did not work for with me at the beginning?

[@AaryadevVRBLX]

Hello , I am not able to drag the malware folder from the host to FlareVM, anyone please help

[@mahetsiedahi6530]

were you able to solve the problem?

[@AaryadevVRBLX]

@@mahetsiedahi6530 ITS BEEN A YEAR

[@kzkaa.]

@@mahetsiedahi6530 Turn on host to guest in the drag-and-drop setting

[@gameblendingreality]

I had the same issue. I just downloaded it from Flare VM using wget without any issues. I had to set the network settings back to default before doing so. Make sure nothing malicious is actually on the machine if doing this method

[@francesco2092]

at the 4.00.31 i don't understand how i find the metasploit module for use the reverse shell?

[@Katokasu-w4h]

can you tell me where should i download all tools for malware analysis I have Installed Flare VM but some tools are not compelety download

[@NewbieValorantYT]

is it ok to enable the clipboard share feature on flarevm ?

[@Lead3RVideos]

Gonna need to make some time for this.

[@sagartimalsina4120]

Just a quick question.. why does my Network setting is not working? I tried everything but the configuration is just not working in my case? Any solution?

[@114thp7]

Hi, mr Husky. I have a little bit problem. As you showed at 59:09 to run wannacry then try it in my flare VM but wannacry.exe didn't run. I wonder why this happened(defender was off) Thanks in advance

[@mattanderson2074]

You probably have the same issue as me - using a Windows 10 build which is no longer vulnerable to wannacry.

[@114thp7]

@@mattanderson2074 i dont know why, but it worked. Wannacry works properly

[@Old_SDC]

Waiting for Remnux to install 20:58 I’ll be back whenever I remember to continue 24:40

[@filippogiorgiorondo6932]

I have a questio, didn't u disable windows updates and windows defender? bcause im trying to do but when i disable MsMp mi VM explode

[@043-namanvora2]

hey husky i tried to download the repo on my physical host but the defender and browser didn't let me download the repo as it was detection viruses into it can you help me with it please

[@OldDirtyDragon]

Same issue. Best I can find, the latest version of Win10 does not allow users to disable MsMpEng.exe. It is owned by the system. That's Microsoft's main AV scanner. Have not found a way around it yet.

[@043-namanvora2]

@@OldDirtyDragon well bro it is a very simple issue what i did that i cloned the repo using git clone command and further it was downloaded on the pc but i made sure i dont open or unzip the repo, i further enabled the drag n drop from host to machine option temporarily for flarevm after dropping the repo into the flarevm i disabled the drag n drop option from v box and made sure that i have deleted the cloned repo from my physical machine and during all this process i didn't touched or twitch the windows defender should work for you as well

[@MehwishAli-w9i]

floss cmmand not working in my cmd said that it is not recognizeble how to solve this issue

[@quasaaaar]

Edit: I found the answer to the below from your later explanation. However I did waste plenty of time trying to figure out myself. Here what took me further in the wrong direction is when I tried to open the malz file with 7zip and it did actually open it and presented a heirarchy of files and even 2 executables inside. So perhaps you need to rearrange the video so the safety part comes before any detonation. This is so others don't waste time like me (or worse, do something harmful) Thanks. Original post: Hi. At 57:08 you jumped to the next video and started working with the wanacry exe. However the file from the repository extracted in the previous video is ransomeware.wanacy.exe.malz So how did we jump from that to that?!?

[@huskyhacks]

That question and more are addressed in the course FAQ, which is located on the course Discord (link in description). If you get stuck like that please check the Discord, it's likely another student has asked the question before and we can get you back on track

[@quasaaaar]

@@huskyhacks I found another problem in the youtube video. The 2 video parts of basic dynamics with RAT.Unknown are in reverse order. The first video comes 2nd and the 2nd video comes 1st.

[@huskyhacks]

@@quasaaaar Do you mind replying with the time stamps of what you think is out of order? I just skimmed that section and it all looks to be in order

[@quasaaaar]

@@huskyhacks for Rat.unknown: Part 2 @ 2:39:35 Part 1 @ 3:00:55

[@huskyhacks]

@@quasaaaar The samples in the sections you've timestamped are different samples. The course material includes multiple samples in the Basic Dynamic Analysis section. The times you've mentioned correspond to Part 2 from the first sample and Part 1 from the second sample

[@vedantpathak4382]

For Vmware users: If anyone face problem after configuring Static DNS in Flarevm, and on visiting any url or ip you are not getting any output. Please follow below steps: - uncheck connect a host to virtual adapter in vmnet interface - disconnect & reconnect network adapter of remnux and flarevm. - then please do allow port 53, 80, 443, 21 on firewall as it might block incoming traffic. (or simply disable ufw). - Also, always turn on inetsim utlity as inetsim user only. if you will turn on inetsim from root user, dns will not work. dont know the reason

[@ninjaspeedone]

When I try to mount the cdrom I get this error message, mount: /media/cdrom: no medium found on /dev/sr0.

[@amirahabubakar3277]

Go to devices>insert guest additions cd image... >run

[@hyperxalloy4391]

It asks for password ​@@amirahabubakar3277

[@stressless8405]

This is phucking fantastic. Very well explained

[@coolheis7469]

Congrats for ur great work and thanks for the content! I wanted to ask u if the host only adapter is safe because somewhere i read that this is not the case since the vm can communicate with the host.

[@huskyhacks]

I actually just wrote a new section of PMAT about this specifically! notes.huskyhacks.dev/blog/malware-analysis-labs-internal-network-vs-host-only

[@RINAMISHRA-j5h]

Hello Sir, I am facing one issue, whenever I try to arm any binary, win10 defender or firewall removes it, Although all security options are turned off, Via Real Time Protection, Registry entry, group security policy etc. Still whenever any binary is converted to armed mode, windows automatically removes it. Kindly help what to do?

[@nostalgiagore]

cutter and PEview are missing on flarevm

[@hemaraj8223]

While mounting th CD-ROM directory It says no media found under /dev/sr0

[@angelaguirre9384]

Just click on Devices -> Insert Guest Additions CD image... The no media found error should be solved after this

[@ThatBlueFalcon]

@@angelaguirre9384 Thanks for saving me!

[@MAHAABID-s9p]

I am still a beginner, how to install the files to my flare vm and I have no connection to the internet ?

[@muhammedbadawy1543]

You download it into your main machine then enable drag and drop (host to guest) and transfer the files into the Flare VM

[@سعدسعدالدهيمي]

@@muhammedbadawy1543 Will there be any risk to my device?

[@jj691]

@105:10 did you adjust your DNS and just edit that portion out?

[@jj691]

Never mind you cleared the air on this about 10 minutes later! :)

[@khodorj6581]

Hello , I am not able to drag the malware folder from the host to FlareVM, any idea?

[@AaryadevVRBLX]

Hi ,I am facing same issue,Can you please share if you already resolved the problem.

[@imvishal8352]

@@AaryadevVRBLX @khodorj6581 Same here, have you found the way ? do share the idea.

[@tomaszskrzypczak3294]

Hello, you need to enable drag and drop in your VM. On running VM, on toolbar, go to devices -> Drag and Drop -> Host to Guest

[@BorisJohnsonMayor]

Was hoping someone could answer a question regarding downloading file samples directly from an EDR dashboard. For example, 365 Defender from MS allows me to download a password protected zip file with the sample in question. However, as I am signed in with the company admin account used to access the EDR dashboard and subsequently have to download the sample to my work machine, how can this be done safely? Do I create a read only account for the dashboard access and sign in to that account in a lab environment and then download the sample? Do I just download the zipped sample on my work machine and send it elsewhere? I'm trying to limit as much possible risk from downloading a sample during an investigation and unfortunately Microsoft don't make this easier in the 365 defender dashboard.

[@haneesha3548]

i cannot find the flare-vm github repo

[@hasanbacha7796]

Hello, I am trying to find a way to contact Matt Kiely to ask him about his training video i just purchased and i am not able to mount the file.

[@huskyhacks]

Hello, please check the description of this video for some notes about that issue.

[@hyphen686]

Can you show the same lab setup using VMware Workstation Pro? I haven't been able to find a single video on this topic.

[@gameblendingreality]

that's paid for. You can either use VMWare player or VirtualBox for free.

[@hyphen686]

@@gameblendingreality yeah i can intall them in VMWare player, but still struggling in isolating them. it is not the same as VirtualBox.

[@gameblendingreality]

@@hyphen686 so you’re talking about the network settings in vmware? I’d honestly throw it into ChatGPT and that should get you to a fixed spot

[@josephblack7408]

My laptop doesn't support virtualization what to do in this condition?

[@Robalo450]

lolololol

[@junaidsheraz8520]

I'm trying to download labs from the URL given in description but it says "Virus detected" and then stopped downloading. Please solve my query

[@TheRealTopTV]

download it on the vm and not your host, after its down disable nat again

[@reiserkeiser]

That first malware file from close to an hour in just will not execute.

[@mayavik1034]

man disabling the Defender is a real PIA, I tried everything. Being Denied access, even with Administrator access. Does anyone here have any ideas.😰

[@angelaguirre9384]

I'm trying to get through the course but I'm not able to run the powershell script from flare-vm. I'm stuck trying to disable Windows Defender... Damn, I've even followed all the links provided under the github repository to do this but none seem to work. Hence I'm stuck here trying to run the powershell script ...

[@angelaguirre9384]

Just for anyone that might face the same issue. I just went ahead and installed Windows 11 on my VM. I was finally able to disable windows defender with the help of John Hammond's yt video. Flare VM install script has successfully ran and I will be continuing the course later today.

[@buzgie]

listening to all the safety spiels as a linux user is funny. I have a habit of just leaving malware .exes lying around my pc because it can't do anything aha

[@IamJohnKelly]

Do this course teach you how to build your own

[@gadadharnayak5648]

is malware analysis job generally full time job or are there part time jobs as well?

[@sambhavjain6929]

5:02 5:03 5:05

[@opmfa1850]

i installed inetsim and configured it like you did but i dont get a page when i try to access any web site

[@ytriskad3889]

did you fix it?

[@opmfa1850]

@@ytriskad3889 yes but dont remember how

[@Crixus0112]

@@ytriskad3889 Hey, I had the same issue you had and was able to get it to work. Let me know if you still have this issue and I can tell you how I got mine to work and that might help in oyur case.

[@ytriskad3889]

@@Crixus0112 yeah that would be nice

[@wokhead]

WannaCry doesnt work((

[@nishadbabu8130]

this course related to TCM security pratical malware analysis

[@PavithraRR-e9c]

Thank you very much for this video, can I get your mail id so that can discuss which are related to this in details. Am a PhD student and faculty in an organization, my work on this is very interesting.

[@Muhammad80008]

Cool :)

[@emilisha-in4xl]

Is this course basic or advanced?

[@RINAMISHRA-j5h]

hello

[@piyushgayaki9667]

Thanks a lot sir. Just what to know for after ransomware detonation which tools I can use for dynamic analysis like you have shown how to use procmon and procexp but when I detonate the ransomware tools get crash.

[@jackymarcel4108]

Martin Scott Garcia Charles Young Anthony

[@hydradragonantivirus]

Malware analysis didn't work anymore.

[@AntonMaverick94]

May I know why?

[@SerikPoliasc]

Williams Daniel Williams Karen Clark Thomas

[@MuhaiminHamzi]

Isn't this a paid course?

[@cyrusmutua9276]

Full course covers up to 9 hours, the first 5 hours are completely free.

[@Robalo450]

Can anyone get past the "The Installer GUI" where you can select the different packages you want installed? I dont have the option to confirm yes or no and proceed.

[@modbat9463]

why i cant open the Malware.Unknown.exe ? if i renamed it from .exe.malz to .exe it wont run at all. it says i have to look in the microsoft store to search an app to run it. And could anyone tell me how to get the malware on the vm without compromising my main operating system? Thanks and Great video!