Skip to content
Hallway
0:00 / 0:00

#icedid#bokbot#idapro

Reverse Engineering IcedID / Bokbot Malware Part 2

OALabs

52K subscribers • 40 videos on Hallway

YouTube
  • Recommended by 1 person: 1 in engineering communities.
  • Linked in the descriptiondanielplohmann/apiscout
  • May be out of date. The tools, versions or practices it shows have likely moved on.

Intermediate. Assumes working knowledge.

7.8K views7 years ago1 recommendation

SecurityReverse engineeringExploits and vulnerabilitiesWeb and application security

This tutorial demonstrates how to unpack and reverse engineer the IcedID malware injection component using IDA Pro, x64dbg, and API Scout.

We reverse engineer the IcedID custom malware injection component using IDA Pro, x64dbg, and some Python (API Scout). Expand for details... ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- - Unpacking live with x64dbg - Attaching to 2nd process to dump code - OEP of injected code (and dynamic building of IAT) - Find other injected code sections by reference - Loading injected code sections into IDA Pro - Using API Scout to label APIs in injected code - Building structs in IDA Pro and re-labeling data - Final overview of unpacking steps See unpacking Bokbot part 1 here: youtu.be/wObF9n2UIAM Original sample: 0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e cape.contextis.com/analysis/21237/ Stage1 (packed UPX): 7f463bd55aa360032fbd6489b4e34455178a35254ff66c1cd98d0775437074b4 cape.contextis.com/analysis/21240/ Stage2 (custom injector): 89a0325379e1e868b668955ed41ba0faa724845028bc961a0691f19e5213dedf cape.contextis.com/analysis/21241/ Talos blog post on Bokbot injection method: blog.talosintelligence.com/2018/04/icedid-banking-trojan.htm… Vitali Kremez analysis of IcedID: vkremez.com/2018/09/lets-learn-deeper-dive-into.html TOOLS - API Scout github.com/danielplohmann/apiscout TUTORIAL - How to setup a FREE malware analysis VM oalabs.openanalysis.net/2018/07/16/oalabs_malware_analysis_v… TUTORIAL - Understanding API calls in Windows (ntdll.dll, kernel32.dll) youtu.be/CiZ5D6wlIrw TUTORIAL - Fast unpacking by hooking RtlDecompressBuffer youtu.be/2zYokTkzIC8 Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net

Why it's here

1 person recommends this

u/herrcorein r/ReverseEngineering • Recommends

Reverse Engineering IcedID / Bokbot Malware Part 2 (OALabs Tutorial)
39View on Reddit