u/herrcorein r/ReverseEngineering • Recommends
Lazy String Decryption Tips With IDA PRO and Shade Ransomware Unpacked! (OALabs Tutorial)
0:00 / 0:00
#idapro#x64dbg#shaderansomware
Lazy String Decryption Tips With IDA PRO and Shade Ransomware Unpacked!
OALabs
52K subscribers • 40 videos on Hallway
- Recommended by 1 person: 1 in engineering communities.
- May be out of date. The tools, versions or practices it shows have likely moved on.
Intermediate. Assumes working knowledge.
19K views7 years ago1 recommendation
SecurityReverse engineeringExploits and vulnerabilities
This tutorial shows how to unpack Shade ransomware using x64dbg and quickly decrypt strings and resolve dynamic imports in IDA Pro.
We use x64dbg debugger to unpack troldesh / shade ransomware then we use IDA PRO to quickly decrypt strings and resolve dynamic imports. Expand for details... ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- Original packed sample: b1f13a9ef3da3c9bd2cfd0fcfd7368b48346a6995a91dd0edca12557773a7763 cape.contextis.com/analysis/28279/# Ransom note: pastebin.com/ghYY0xQE Any.Run: app.any.run/tasks/e1cd0797-c4d2-4a5c-aedf-20330a79fe3f ID-Ransomware: id-ransomware.malwarehunterteam.com/index.php Talos FIRST (shared code identification): talosintelligence.com/first Build your own FREE malware analysis VM: oalabs.openanalysis.net/2018/07/16/oalabs_malware_analysis_v… Michael's Ransomware Analysis YouTube channel: youtube.com/channel/UCDbWhUnMdhxi2bo-oZQ1m3Q Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net #IDAPro #Tutorial #ReverseEngineering