HuskyHacks
HuskyHacks
  • 39
  • 336 945
decompile the halls | TryHackMe Advent of Cyber 2023 Day 9 [Malware Analysis]
Ayo as a side note, I teach malware analysis professionally over at TCM Security Academy! I run a 9+ hour course called Practical Malware Analysis & Triage which covers this subject and many others. Check it out over there if you're interested!
AND... the first 5 hours of that course are on TH-cam for free! Check it out here: th-cam.com/video/qA0YcYMRWyI/w-d-xo.html
Practical Malware Analysis & Triage: academy.tcm-sec.com/p/practical-malware-analysis-triage
00:00-06:00 - intro, story background, malware analysis concepts, .NET and decompilation
06:00-07:10 - loading sample into dnSpy, examining the decompiled code
07:10- 08:10 - briefly covering C2 architecture
08:10-16:00 - analyzing the decompiled code, analyzing each function, identifying key characteristics of a C2 agent, reverse engineering the malware's capabilities
16:00-19:10 - answering the challenge questions by referencing the code of the sample
19:10-19:53 - outtro. have a great holiday! 💖
มุมมอง: 15 727

วีดีโอ

we are so-ho-ho back | TryHackMe Advent of Cyber 2023 Day 2 [Python + Jupyter Notebooks]
มุมมอง 24Kปีที่แล้ว
00:00-00:45 - ya boi is back. intro. 00:45-05:19 - exposition, Python, Jupyter notebooks, background 05:19-16:00 - Notebook 1: Intro to Python/Jupyter notebooks, data types, variables, type inference, running cells, markdown 16:00-23:50 - Notebook 2: Intro to Pandas, dataframes, series, simple data manipulations 23:50-27:25 - Notebook 3: Intro to Matplotlib, making graphs from dataframes 27:25-...
I, Too, Stole a Microsoft 365 Account. Here's How. (Stealing Access Tokens from Office Desktop Apps)
มุมมอง 8Kปีที่แล้ว
Attacking & Defending Azure & M365 - Xintra Training: training.xintra.org/view/courses/attacking-and-defending-azure-m365 mrd0x original writeup: mrd0x.com/stealing-tokens-from-office-applications/ TokenFinder: github.com/doredry/TokenFinder I also reimplemented TokenFinder in C#: github.com/HuskyHacks/SharpTokenFinder
Malware C2 Keying! Speakfriend | Huntress 2023 Capture the Flag
มุมมอง 623ปีที่แล้ว
Malware C2 Keying! Speakfriend | Huntress 2023 Capture the Flag
breaking WEAK ENCRYPTION. BlackCat Walkthrough | Huntress 2023 Capture the Flag
มุมมอง 476ปีที่แล้ว
breaking WEAK ENCRYPTION. BlackCat Walkthrough | Huntress 2023 Capture the Flag
c r a b | Crab Rave Walkthrough | Huntress 2023 Capture the Flag
มุมมอง 475ปีที่แล้ว
Responsible Red Teaming: taggartinstitute.org/p/responsible-red-teaming
this computer READS YOUR MIND. Rock, Paper, Psychic | Huntress 2023 CTF
มุมมอง 559ปีที่แล้ว
this computer READS YOUR MIND. Rock, Paper, Psychic | Huntress 2023 CTF
PyArmor Malware! Snake Eater Walkthrough | Huntress Capture The Flag 2023
มุมมอง 939ปีที่แล้ว
PyArmor Malware! Snake Eater Walkthrough | Huntress Capture The Flag 2023
he back and he MAD 💢 Black Cat II Walkthrough | Huntress 2023 Capture the Flag
มุมมอง 365ปีที่แล้ว
he back and he MAD 💢 Black Cat II Walkthrough | Huntress 2023 Capture the Flag
don't call it a comeback. Snake Eater II Walkthrough | Huntress 2023 Capture the Flag
มุมมอง 379ปีที่แล้ว
don't call it a comeback. Snake Eater II Walkthrough | Huntress 2023 Capture the Flag
Cloudy with a Chance of Malware: Moving Malware Analysis to the Cloud
มุมมอง 2.4Kปีที่แล้ว
Presented to the Cloud Security Alliance of LA/SoCal
It was sublime. Husky Hikes the AT 2023 (Finale)
มุมมอง 435ปีที่แล้ว
It was sublime. Husky Hikes the AT 2023 (Finale)
I. Do. Not. Yield!!! - Husky Hikes the AT 2023 (Part 14)
มุมมอง 251ปีที่แล้ว
I. Do. Not. Yield!!! - Husky Hikes the AT 2023 (Part 14)
We Crushed the White Mountains* (*they crushed us back tho) | Husky Hikes the AT 2023 (Part 13)
มุมมอง 174ปีที่แล้ว
We Crushed the White Mountains* (*they crushed us back tho) | Husky Hikes the AT 2023 (Part 13)
POV: you’re hiking the hardest mile on the Appalachian Trail - Husky Hikes the AT 2023 (Bonus!)
มุมมอง 426ปีที่แล้ว
POV: you’re hiking the hardest mile on the Appalachian Trail - Husky Hikes the AT 2023 (Bonus!)
relaxing Appalachian Trail content from CT, MA, & VT 😌 - Husky Hikes the AT 2023 (Part 12)
มุมมอง 195ปีที่แล้ว
relaxing Appalachian Trail content from CT, MA, & VT 😌 - Husky Hikes the AT 2023 (Part 12)
A hidden gem beach | Manhattan Skyline | Retracing Steps - Husky Hikes the AT 2023 (Part 11)
มุมมอง 214ปีที่แล้ว
A hidden gem beach | Manhattan Skyline | Retracing Steps - Husky Hikes the AT 2023 (Part 11)
The… other part of PA. New Jersey is actually gorgeous - Husky Hikes the AT 2023 (Part 10)
มุมมอง 184ปีที่แล้ว
The… other part of PA. New Jersey is actually gorgeous - Husky Hikes the AT 2023 (Part 10)
Halfway Point. 🦝 Raccoon Raid. The Good Part of PA- Husky Hikes the AT 2023 (Part 9)
มุมมอง 202ปีที่แล้ว
Halfway Point. 🦝 Raccoon Raid. The Good Part of PA- Husky Hikes the AT 2023 (Part 9)
Virginia Blues & Shenandoah Views - Husky Hikes the AT 2023 (Part 8)
มุมมอง 209ปีที่แล้ว
Virginia Blues & Shenandoah Views - Husky Hikes the AT 2023 (Part 8)
…and goats. Husky Hikes the AT 2023 (Part 7)
มุมมอง 230ปีที่แล้ว
…and goats. Husky Hikes the AT 2023 (Part 7)
ponies. Husky Hikes the AT 2023 (Part 6)
มุมมอง 214ปีที่แล้ว
ponies. Husky Hikes the AT 2023 (Part 6)
Achievement Unlocked: Marathon Man - Husky Hikes the AT 2023 (Part 5)
มุมมอง 230ปีที่แล้ว
Achievement Unlocked: Marathon Man - Husky Hikes the AT 2023 (Part 5)
The Roan Mountain Gambit - Husky Hikes the AT 2023 (Part 4)
มุมมอง 376ปีที่แล้ว
The Roan Mountain Gambit - Husky Hikes the AT 2023 (Part 4)
My hat goes off to Big Bald. Literally - Husky Hikes the AT 2023 (Part 3)
มุมมอง 325ปีที่แล้ว
My hat goes off to Big Bald. Literally - Husky Hikes the AT 2023 (Part 3)
A brush with injury - Husky Hikes the AT 2023 (Part 2)
มุมมอง 326ปีที่แล้ว
A brush with injury - Husky Hikes the AT 2023 (Part 2)
The hardest part is over - Husky Hikes the AT 2023 (Part 1)
มุมมอง 628ปีที่แล้ว
The hardest part is over - Husky Hikes the AT 2023 (Part 1)
GAZELLEKIT - My AT 2023 NOBO Gear Kit
มุมมอง 364ปีที่แล้ว
GAZELLEKIT - My AT 2023 NOBO Gear Kit
i'm leaving.
มุมมอง 2.5Kปีที่แล้ว
i'm leaving.
a bold offensive, a daring escape (4K)
มุมมอง 1.3Kปีที่แล้ว
a bold offensive, a daring escape (4K)

ความคิดเห็น

  • @TheTntwilliams
    @TheTntwilliams 4 วันที่ผ่านมา

    Great video and was wondering if you have AV enabled when you run your samples on the VM or did you disable

  • @IamJohnKelly
    @IamJohnKelly 6 วันที่ผ่านมา

    Do this course teach you how to build your own

  • @mahetsiedahi6530
    @mahetsiedahi6530 10 วันที่ผ่านมา

    I'm reaching out for help with a blue-jupyter installation on renmux. I'm stuck at the container building stage, using the command "sudo docker build -t bluejupyter .". Unfortunately, I'm getting this error: ERROR: failed to solve: process "/bin/sh -c pip3 install -r requirements.txt" did not complete successfully: exit code: 1 Any suggestions on how to proceed would be greatly appreciated.

  • @spammers7431
    @spammers7431 19 วันที่ผ่านมา

    Just completed this course its soooo awsome

  • @vedantpathak4382
    @vedantpathak4382 หลายเดือนก่อน

    For Vmware users: If anyone face problem after configuring Static DNS in Flarevm, and on visiting any url or ip you are not getting any output. Please follow below steps: - uncheck connect a host to virtual adapter in vmnet interface - disconnect & reconnect network adapter of remnux and flarevm. - then please do allow port 53, 80, 443, 21 on firewall as it might block incoming traffic. (or simply disable ufw). - Also, always turn on inetsim utlity as inetsim user only. if you will turn on inetsim from root user, dns will not work. dont know the reason

  • @Katokasu-w4h
    @Katokasu-w4h 2 หลายเดือนก่อน

    can you tell me where should i download all tools for malware analysis I have Installed Flare VM but some tools are not compelety download

  • @GaryBales-q3n
    @GaryBales-q3n 2 หลายเดือนก่อน

    The vbox files on the cdrom exist but on Remnux the files do not exist in cdrom anywhere. I have watched the video up the the sudo mount segment 3x but not sure what to try differently. Thanks

  • @isuamalinato1803
    @isuamalinato1803 2 หลายเดือนก่อน

    Hello, I’m stuck at the remnux phase where I’m supposed to mount a media It’s keeps telling me “/decdrom” does not exist I look forward to your assistance, thank you

  • @hristinaivanova2238
    @hristinaivanova2238 2 หลายเดือนก่อน

    Hi, I have an issue with the inetsim. I have done everything correctly step by step but I only get the message about the fake mode when I navigate to the 10.0.0.3 remnux IP. When I try to run any other site I get 'this site can't be reached'. Can I have some help, please?

  • @ArafatAli-vc8yr
    @ArafatAli-vc8yr 3 หลายเดือนก่อน

    Amazing walkthrough ! You make coding look like a piece of cake

  • @D3ltaLabs
    @D3ltaLabs 3 หลายเดือนก่อน

    How am I only finding your channel now.. great tutor. I'll slowly watch all your videos now.

  • @TRVNC3
    @TRVNC3 3 หลายเดือนก่อน

    This is good. This is really good. How long would the safe run time for the malware/malware exposed sandbox be?

  • @SerikPoliasc
    @SerikPoliasc 3 หลายเดือนก่อน

    Williams Daniel Williams Karen Clark Thomas

  • @wokhead
    @wokhead 3 หลายเดือนก่อน

    WannaCry doesnt work((

  • @jackymarcel4108
    @jackymarcel4108 4 หลายเดือนก่อน

    Martin Scott Garcia Charles Young Anthony

  • @Macj707
    @Macj707 4 หลายเดือนก่อน

    chef wuz here

  • @niless577
    @niless577 5 หลายเดือนก่อน

    It was an amazing and helpful tutorial for beginner malware analiyst. Thank you so much, I was searching something like this and your content is exactly what I was looking on the internet. Thank you again🤗

  • @queenhannah8007
    @queenhannah8007 5 หลายเดือนก่อน

    What if we have the access token

  • @NewbieValorantYT
    @NewbieValorantYT 5 หลายเดือนก่อน

    is it ok to enable the clipboard share feature on flarevm ?

  • @Robalo450
    @Robalo450 6 หลายเดือนก่อน

    How do you get PEView?

  • @EliteBuildingCompany
    @EliteBuildingCompany 6 หลายเดือนก่อน

    I was struggling with the very last part finding the phpinfo file, danke.

  • @rasperss_5176
    @rasperss_5176 6 หลายเดือนก่อน

    One tip, personally I would go the extra step and by ensuring clipboard sharing is disabled when deploying malware. I don't think he mentioned that and did notice he had it enabled when copying hashes to virus[.]total just my two cents. But great video none the less!

    • @gameblendingreality
      @gameblendingreality 4 หลายเดือนก่อน

      It looks like Flare VM already defaults to disabling the clipboard

  • @114thp7
    @114thp7 6 หลายเดือนก่อน

    Hi, mr Husky. I have a little bit problem. As you showed at 59:09 to run wannacry then try it in my flare VM but wannacry.exe didn't run. I wonder why this happened(defender was off) Thanks in advance

    • @mattanderson2074
      @mattanderson2074 6 หลายเดือนก่อน

      You probably have the same issue as me - using a Windows 10 build which is no longer vulnerable to wannacry.

    • @114thp7
      @114thp7 6 หลายเดือนก่อน

      @@mattanderson2074 i dont know why, but it worked. Wannacry works properly

  • @arturcorreia6615
    @arturcorreia6615 7 หลายเดือนก่อน

    Windows Defender is not letting me detonate de virus :(

  • @luckbeforeleap
    @luckbeforeleap 8 หลายเดือนก่อน

    Dumping the access tokens is nice but dumping the refresh tokens would be cooler :)

  • @hyphen686
    @hyphen686 8 หลายเดือนก่อน

    Can you show the same lab setup using VMware Workstation Pro? I haven't been able to find a single video on this topic.

    • @gameblendingreality
      @gameblendingreality 4 หลายเดือนก่อน

      that's paid for. You can either use VMWare player or VirtualBox for free.

    • @hyphen686
      @hyphen686 4 หลายเดือนก่อน

      @@gameblendingreality yeah i can intall them in VMWare player, but still struggling in isolating them. it is not the same as VirtualBox.

    • @gameblendingreality
      @gameblendingreality 4 หลายเดือนก่อน

      @@hyphen686 so you’re talking about the network settings in vmware? I’d honestly throw it into ChatGPT and that should get you to a fixed spot

  • @Conspiranoiiico
    @Conspiranoiiico 8 หลายเดือนก่อน

    A file can perform certain checks on the system before downloading and executing the final malware, such as checking if the system is a virtual machine, for example by looking for this registry key: *HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools* I think that all possible traces of virtualization must be eliminated

  • @MAHAABID-s9p
    @MAHAABID-s9p 8 หลายเดือนก่อน

    I am still a beginner, how to install the files to my flare vm and I have no connection to the internet ?

    • @muhammedbadawy1543
      @muhammedbadawy1543 6 หลายเดือนก่อน

      You download it into your main machine then enable drag and drop (host to guest) and transfer the files into the Flare VM

    • @سعدسعدالدهيمي
      @سعدسعدالدهيمي 3 หลายเดือนก่อน

      @@muhammedbadawy1543 Will there be any risk to my device?

  • @haneesha3548
    @haneesha3548 8 หลายเดือนก่อน

    i cannot find the flare-vm github repo

  • @TheRikkieg
    @TheRikkieg 8 หลายเดือนก่อน

    Thanks! The information about the jwt token helped me find a big vulnerability

  • @johnvardy9559
    @johnvardy9559 8 หลายเดือนก่อน

    I Just found you , and you have great Content. Im trying to learn some stuff, how to be soc Analyst?

  • @KothariHitarth
    @KothariHitarth 9 หลายเดือนก่อน

    Can you make a video by testing the any malware in kali Linux , I mean whole malware analysis on kali Linux with Linux tools .

  • @sagartimalsina4120
    @sagartimalsina4120 9 หลายเดือนก่อน

    Just a quick question.. why does my Network setting is not working? I tried everything but the configuration is just not working in my case? Any solution?

  • @043-namanvora2
    @043-namanvora2 9 หลายเดือนก่อน

    hey husky i tried to download the repo on my physical host but the defender and browser didn't let me download the repo as it was detection viruses into it can you help me with it please

    • @OldDirtyDragon
      @OldDirtyDragon 9 หลายเดือนก่อน

      Same issue. Best I can find, the latest version of Win10 does not allow users to disable MsMpEng.exe. It is owned by the system. That's Microsoft's main AV scanner. Have not found a way around it yet.

    • @043-namanvora2
      @043-namanvora2 9 หลายเดือนก่อน

      @@OldDirtyDragon well bro it is a very simple issue what i did that i cloned the repo using git clone command and further it was downloaded on the pc but i made sure i dont open or unzip the repo, i further enabled the drag n drop from host to machine option temporarily for flarevm after dropping the repo into the flarevm i disabled the drag n drop option from v box and made sure that i have deleted the cloned repo from my physical machine and during all this process i didn't touched or twitch the windows defender should work for you as well

  • @sambhavjain6929
    @sambhavjain6929 9 หลายเดือนก่อน

    5:02 5:03 5:05

  • @hydradragonantivirus
    @hydradragonantivirus 10 หลายเดือนก่อน

    Malware analysis didn't work anymore.

  • @repairstudio4940
    @repairstudio4940 10 หลายเดือนก่อน

    This has been such an amazing journey. Much respect to Husky! Heath's crew @ TCM are awesome! 🎉

  • @repairstudio4940
    @repairstudio4940 10 หลายเดือนก่อน

    Man thank you this has been amazing. Liked and Subbed and going to recommend your channel. 💙💻🦠😎

  • @PavithraRR-e9c
    @PavithraRR-e9c 10 หลายเดือนก่อน

    Thank you very much for this video, can I get your mail id so that can discuss which are related to this in details. Am a PhD student and faculty in an organization, my work on this is very interesting.

  • @FRITTY12348546
    @FRITTY12348546 10 หลายเดือนก่อน

    I enjoyed these! thanks for writing them coming back now to see the ones I missed

  • @piyushgayaki9667
    @piyushgayaki9667 10 หลายเดือนก่อน

    Thanks a lot sir. Just what to know for after ransomware detonation which tools I can use for dynamic analysis like you have shown how to use procmon and procexp but when I detonate the ransomware tools get crash.

  • @GadKhix
    @GadKhix 10 หลายเดือนก่อน

    I swear to God, This is very good malware analysis for real, I will recommend to my folks, HuskyHacks, Thank you for everything

  • @atikullah9066
    @atikullah9066 10 หลายเดือนก่อน

    best malware analysis course. Thanks for this amazing course

  • @MehwishAli-w9i
    @MehwishAli-w9i 10 หลายเดือนก่อน

    floss cmmand not working in my cmd said that it is not recognizeble how to solve this issue

  • @RINAMISHRA-j5h
    @RINAMISHRA-j5h 10 หลายเดือนก่อน

    hello

  • @RINAMISHRA-j5h
    @RINAMISHRA-j5h 10 หลายเดือนก่อน

    Hello Sir, I am facing one issue, whenever I try to arm any binary, win10 defender or firewall removes it, Although all security options are turned off, Via Real Time Protection, Registry entry, group security policy etc. Still whenever any binary is converted to armed mode, windows automatically removes it. Kindly help what to do?

  • @MehwishAli-w9i
    @MehwishAli-w9i 11 หลายเดือนก่อน

    In remnux when i mount it said no medium found on dev/sro what i can do for these

    • @gameblendingreality
      @gameblendingreality 4 หลายเดือนก่อน

      Go to devices>insert guest additions cd image... >run

    • @skullhead8381
      @skullhead8381 7 วันที่ผ่านมา

      @@gameblendingreality thanks i have been struggling with this for 3 days now i don't really know how to use linux so i am using virtualbox but whenever i install a live cd or ova no medium found occurs

  • @nicksunny100
    @nicksunny100 11 หลายเดือนก่อน

    Subscribed!!

  • @nelsoncorreia7293
    @nelsoncorreia7293 11 หลายเดือนก่อน

    Decided to run through AoC 2022 after doing the 2023 version because I found it very informative. I got stuck on one question and this helped me out. Thanks.

  • @Hanacan75
    @Hanacan75 11 หลายเดือนก่อน

    Thank you my friend. Excelent tutorial :) I'm cheering for you to do more. hhaha