IDA Pro Scripting Intro - Automate Dynamic Import Resolving for REvil Ransomware

An introduction to IDA Python scripting to automate resolving dynamic imports in REvil ransomware.

Join us for an introduction to IDA Python scripting. In this tutorial we automate resolving the dynamic imports for REvil ransomware. Expand for more... ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- Automated Malware Unpacking unpac.me/ This is the 3rd video in a series where we learn some malware reverse engineering fundamentals using the REvil ransomware sample. Part 1 - Unpacking REvil malware: youtu.be/0raUaL4TIo4 Part 2 - Reversing the import hash algorithm: youtu.be/hM2Zvsak3GM Clean unpacked REvil sample: 5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93 malshare.com/sample.php?action=detail&hash=890a58f200dfff231… IDA python REvil import builder script: gist.github.com/OALabs/fc68ad4d63fd68c910f32d66fa5e981d DLL export dictionary builder script: gist.github.com/OALabs/94ff4fc02bf02d55a8161068cafd11c0 Exports DB (json): gist.github.com/OALabs/536fede0b4ef58fe6ba4d5bde12a78d5 Excellent IDA Python book: leanpub.com/IDAPython-Book FireEye Flare Hash Tool: github.com/fireeye/flare-ida/tree/master/shellcode_hashes Excellent blog post on dynamic API hashes: blag.nullteilerfrei.de/2019/11/09/api-hashing-why-and-how/ Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net #ReverseEngineering #IDAPro #IDAPython