Skip to content
Hallway
0:00 / 0:00

#revil#sodinokibi#x64dbg

REvil Ransomware Unpacked - Cheeky Hack To Build Import Address Table

OALabs

52K subscribers • 40 videos on Hallway

YouTube
  • Recommended by 1 person: 1 in engineering communities.

Advanced. Deep dive for people who know the field.

19K views7 years ago1 recommendation

SecurityReverse engineeringExploits and vulnerabilitiesDebugging

How to unpack Sodinokibi ransomware and use a clever hack to rebuild a fake Import Address Table for dynamically resolved imports.

Just a quick tutorial on how to unpack sodinokibi (revil) ransomware and a neat hack to build a fake import address table for a binary that has dynamically resolved imports. We use x64dbg, scylla, and IDA free. ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- Packed ransomware: bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9 malshare.com/sample.php?action=detail&hash=61c19e7ce627da9b5… Clean dump of unpacked ransomware: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93 malshare.com/sample.php?action=detail&hash=890a58f200dfff231… Unpacked ransomware with hacked IAT: ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea malshare.com/sample.php?action=detail&hash=fb9d11c5ff87dd907… Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net #x64dbg #Ransomware #MalwareAnalysis

Why it's here

1 person recommends this

What people say. Recommended as a tutorial on unpacking REvil ransomware and handling dynamic imports.

u/herrcorein r/ReverseEngineering • Recommends

REvil Ransomware Unpacked - Cheeky Hack To Build Import Address Table For Dynamic Imports (OALabs Tutorial)
51View on Reddit