Unpacking Redaman Malware & Basics of Self-Injection Packers - ft. OALabs

OALabs and LiveOverflow demonstrate how to unpack Redaman malware and explain the basics of self-injection packers using x64dbg and IDA.

OALabs shows a walk-through of how to unpack a sample malware and explains some basics about packers. You can learn about using x64debug, IDA and PE-Bear. LEARN ON HEXTREE (ad) Learn hacking on Hextree: hextree.io/ Join the Hextree Discord: discord.gg/xgQpCQCpvy OALabs: youtube.com/channel/UC--DwaiMV-jtO-6EvmKOnqg CHAPTERS 00:00 - OALabs Introduces Redaman Malware 01:25 - Self-Injection and PE Section Overwrite 04:55 - Preparing the Malware Analysis VM 05:45 - Breaking on VirtualAlloc and VirtualProtect 08:12 - Finding and Dumping the First PE Payload 10:02 - Validating the Dump and Confirming PE Overwrite 12:55 - Identifying a Packed Second Stage in IDA 14:45 - XOR Decryption, Decompression, and Dynamic APIs 17:15 - Writing and Loading the Temporary DLL 19:33 - Extracting the DLL with a LoadLibraryW Breakpoint 21:53 - Revealing the Hidden DLL with attrib 23:10 - Inspecting the Unpacked DLL and Remaining Obfuscation 24:53 - Self-Injection Unpacking Workflow Recap SUPPORT Per video: patreon.com/join/liveoverflow Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: youtube.com/LiveUnderflow Twitch: twitch.tv/LiveOverflow/ Twitter: twitter.com/LiveOverflow/ Instagram: instagram.com/LiveOverflow/ TikTok: tiktok.com/@liveoverflow_ LiveOverflow blog: liveoverflow.com/ Hextree blog (ad): hextree.io/blog #MalwareAnalysis (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.