Malware Theory - How Packers Work, Polymorphism and Misconceptions

[@cruelsister1]

Superb! Thank you for the time it took you to write and produce this video. Education is a wonderful thing.

[@christauff]

This was very clear and easy to follow. Thank you.

[@clemdem4572]

Very good video thanks for this clear to the point explanation !

[@yungdawwg7081]

hello, i have a question regarding the case of using new malware code which is essentially a zero day but packing it with a "tagged" stub, that will result with the file being detected as mw. My question then is it possible for a malware writer to know which stub is unused, or it's impossible since it depends on the packer which chooses randomly, then we are left with two options either there is a packer in the dark web used by hackers which removes a stub each time they sell it to a buyer. or the malware owner tries his packed file with multiple AVs many times until it's not detected ? sorry if i turned it into a monolog i just got lost speaking outloud.

[@seif9923]

hey man, I have a question, how do I test the malware that I made I don't want to upload it virustotal obviously I just want to test without it getting detected.

[@IIIIII-ke3lo]

Kleenscan

[@banannadb2213]

You mentioned common malware actors will use packers, but APTs would not. What would APTs use or otherwise do to serve the same purpose?

[@MalwareAnalysisForHedgehogs]

I misspoke. I meant samples for targeted attacks. Malware that is spread on masse needs packing for evasion in the long run, but not malware that is used once or twice for a specific target. So often targeted samples are not packed.

[@IIIIII-ke3lo]

Couldnt a malware devloper use a c2 to create self morphing malware by having the malware send a request to the c2 to reobfuscate and recompile the malware then send the new malware back and have it replace the old one, this would allow for long time persistence because even if the original stub gets detected it would have already changed completely

[@MalwareAnalysisForHedgehogs]

Sure, but that is not called packing.

[@firos5381]

could u ever do a demo vedio of al this packking and all of mayb a simple metsploit payload or smthg common u see everytime

[@MalwareAnalysisForHedgehogs]

I think that's a good idea if coupled with how to unpack those again. But I cannot promise anything. I am currently very involved with other projects.

[@bhumiputra6108]

Thanks for the explanation. 😘

[@johnczech7074]

Thanks!

[@hassnainjaved7399]

Kindly more videos