AhmedS Kasmani
AhmedS Kasmani
  • Видео 35
  • Просмотров 64 620
Malware 101: Injection Basics - Remote Shellcode Injection
This is a continuation of the series where I will share the basics of Malware.
In this video we discuss one of the many ways for a process to inject shellcode into another process.
Offensive Development Course: ask-academy.live/courses/offensive-development-and-tradecraft/
Code: discord.gg/SpdTFCAAzG
Please provide feedback in the comments.
To continue the conversation hit me up on twitter:
🐦 Twitter - nu11charb
Просмотров: 751

Видео

Malware 101: Injection Basics - Local Shellcode Injection
Просмотров 705Месяц назад
This is a continuation of the series where I will share the basics of Malware. In this video we discuss a couple of simple ways for a process to inject shellcode into its process. Offensive Development Course: ask-academy.live/courses/offensive-development-and-tradecraft/ Code: discord.gg/SpdTFCAAzG Please provide feedback in the comments. To continue the conversation hit me up on twitter: 🐦 Tw...
Malware 101: Injection Basics - Dll Injection
Просмотров 609Месяц назад
In this video we continue our journey in the world of Malware. This is a continuation of the series where I will share the basics of Malware. Here we discuss Dll Injection, this is a very important technique to understand as it forms the basics of Process Injection. This is also important to understand for Api Hooking. Offensive Development Course: ask-academy.live/courses/offensive-development...
Malware Evasion 101: Detecting Debugger and Analysis Software
Просмотров 298Месяц назад
In this video we continue our journey in the world of Malware. This is a continuation of the series where I will share the basics of Malware. Offensive Development Course: ask-academy.live/courses/offensive-development-and-tradecraft/ Code: discord.gg/SpdTFCAAzG Please provide feedback in the comments. To continue the conversation hit me up on twitter: 🐦 Twitter - nu11charb
Malware 101: Writing your first Exe and Dll in C
Просмотров 1,7 тыс.Месяц назад
In this video we dive into the world of Malware. This will be a series where I will share the basics of Malware. Offensive Development Course: ask-academy.live/courses/offensive-development-and-tradecraft/ Basics of PE File: learn.microsoft.com/en-us/windows/win32/debug/pe-format Code: discord.gg/SpdTFCAAzG Please provide feedback in the comments. To continue the conversation hit me up on twitt...
Latrodectus - Malware Analysis Part 2
Просмотров 5372 месяца назад
This is part 2 of the analysis of the Latrodectus Malware. In this video we will look at the final payload. Final Payload Download Link: hxxps[://]bazaar[.]abuse[.]ch/sample/d843d0016164e7ee6f56e65683985981fb14093ed79fde8e664b308a43ff4e79/ Code Repo: github.com/nullcharb/LatrodectusYT Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: ask-academy.live/ Please p...
Latrodectus - Malware Analysis Part 1
Просмотров 9482 месяца назад
In this part 1/2 we will be doing analysis of Latrodectus Malware. Stage1: Javascript Download Link: hxxps[://]bazaar[.]abuse[.]ch/sample/4ff60df7d165862e652f73752eb98cf92202a2d748b055ff1f99d4172fa4c92f/ Stage3: Msi File Download Link: hxxps[://]bazaar[.]abuse[.]ch/sample/3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f Course Link: courses.null-char.com/courses/the-art-of-malwa...
Introducing new course "Offensive Development and Tradecraft"
Просмотров 2964 месяца назад
Hey Friends, In this video I am introducing my new course "Offensive Development and Tradecraft" The course website: ask-academy.live/courses/offensive-development-and-tradecraft/ Please provide feedback in the comments. To continue the conversation hit me up on twitter: 🐦 Personal Twitter - nu11charb 🐦 Academy Twitter - askacademylive
Shellcode Loader Analysis and Python3 Scripting in Ghidra
Просмотров 4977 месяцев назад
In this video I share how use Python3 Scripting in Ghidra to scripts for Shellcode loader Analysis and Shellcode Extraction. Links to the Github Repo for the code: github.com/nullcharb/GhidraScripting Link to the sample: hxxps[://]bazaar[.]abuse[.]ch/sample/733be2c75022f979e6568281e76da5fd3c709ddac41a3e644f0ff88432c5d248/ This is a must watch video for people interested in Malware Analysis, Sec...
Ghidra UI Updates for Malware Analysis and Introduction to python3 scripting in Ghidra
Просмотров 3208 месяцев назад
We continue our series of Ghidra basics; in this video I share how I improve the UI to make it better for Malware Analysis and introduction to python3 scripting in Ghidra via Ghidrathon. Matthews Article: embee-research.ghost.io/understanding-and-improving-ghidra-ui-for-malware-analysis/ Ghidra Scripting Repo: github.com/nullcharb/GhidraScripting This is a must watch video for people interested...
Malware Analysis Lab Basics - Part 2 - Installing Ghidra
Просмотров 9868 месяцев назад
We continue our series of Malware Analysis Lab basics; in this video I share how I install and configure Ghidra. Ghidra Link: ghidra-sre.org/ Ghidra Dark Theme: github.com/huettenhain/ghidradark Ghidrathon: github.com/mandiant/Ghidrathon Gradle: gradle.org/releases/ This is a must watch video for people interested in Malware Analysis, Security Operations and Security Analyst roles. Course Link:...
Malware Analysis Lab Basics - Part 1 - Installing Flare VM
Просмотров 3,3 тыс.8 месяцев назад
We continue our series of Cyber Security Lab basics; in this video I share how I install and configure FlareVM. FlareVM Github Link: github.com/mandiant/flare-vm This is a must watch video for people interested in Malware Analysis, Security Operations and Security Analyst roles. Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: ask-academy.live/ Please provide...
Cyber Security Lab Basics - Installing EDR in Malware Development Lab
Просмотров 2,4 тыс.9 месяцев назад
In the previous video I showed how to setup Malware Development Lab. In this video we add Elastic EDR to the lab. This is a must watch video for people interested in Security Analyst, Security Engineer, SOC Analyst roles. Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: ask-academy.live/ Please provide feedback in the comments. To continue the conversation hi...
Cyber Security Lab Basics - Setting up Malware Development Lab
Просмотров 1,2 тыс.9 месяцев назад
In this video, I walk through how I setup a Malware Development Lab. This is a very basic Lab where I use Kali linux for compiling code and Windows 10 for debugging and testing the code. This kind of a lab can be the building block for a very comprehensive lab for testing EDR and Security Solutions. Source code link: github.com/nullcharb/MalwareDevelopmentLab-YT Kali Linux Setup commands: sudo ...
NjRat Malware Analysis
Просмотров 4,5 тыс.10 месяцев назад
In this video we will be doing analysis of NjRat Malware. This is a beginner level video for people starting off in malware analysis. Malware Download Link: hxxps[://]bazaar[.]abuse[.]ch/sample/b02c3cc8be9da55c745c60521c8dc3d2c0a1494cfc8127b6785b58496a779383/ Dnspyex: community.chocolatey.org/packages/dnspyex Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: a...
Vidar Stealer Malware Analysis
Просмотров 4,2 тыс.Год назад
Vidar Stealer Malware Analysis
Racoon Stealer V2 Malware Analysis
Просмотров 4,5 тыс.Год назад
Racoon Stealer V2 Malware Analysis
Qakbot Dropper Analysis
Просмотров 4,5 тыс.2 года назад
Qakbot Dropper Analysis
Zloader Malware Analysis - 1. Unpacking First stage.
Просмотров 1,6 тыс.2 года назад
Zloader Malware Analysis - 1. Unpacking First stage.
Malware Analysis of Hancitor maldoc and initial Dlls
Просмотров 1,9 тыс.2 года назад
Malware Analysis of Hancitor maldoc and initial Dlls
Analysis of Malware from Kaseya/Revil Supply Chain attack.
Просмотров 1,9 тыс.3 года назад
Analysis of Malware from Kaseya/Revil Supply Chain attack.
Analysis of AppleJeus Malware by Lazarus Group
Просмотров 1,3 тыс.3 года назад
Analysis of AppleJeus Malware by Lazarus Group
Analysis of malware dropped by Nobelium.
Просмотров 2 тыс.3 года назад
Analysis of malware dropped by Nobelium.
Malware Analysis: Agent Tesla Part 2/2 Final Payload Analysis
Просмотров 1,5 тыс.3 года назад
Malware Analysis: Agent Tesla Part 2/2 Final Payload Analysis
Analysis of ICEID Malware Installer DLL
Просмотров 1,8 тыс.3 года назад
Analysis of ICEID Malware Installer DLL
Malware Analysis: Agent Tesla Part 1/2 Extraction of final payload from dropper.
Просмотров 2,5 тыс.3 года назад
Malware Analysis: Agent Tesla Part 1/2 Extraction of final payload from dropper.
Extract Comrat Malware Dll's from Powershell Dropper
Просмотров 7753 года назад
Extract Comrat Malware Dll's from Powershell Dropper
Malware Analysis: VBScript dropper for NJRat.
Просмотров 1,2 тыс.3 года назад
Malware Analysis: VBScript dropper for NJRat.
Malware Analysis of a Password Stealer
Просмотров 2 тыс.3 года назад
Malware Analysis of a Password Stealer
1- Click Malware Analysis: IcedID JS Dropper
Просмотров 6823 года назад
1- Click Malware Analysis: IcedID JS Dropper

Комментарии

  • @firosiam7786
    @firosiam7786 12 дней назад

    I have a 2 3 doubts sir once u chaged the name tp payload to the demon x64 bin in all places there was already some shell stored in the tp payload variable right so does that get overwriten by the payload inside the demon x64 bin. Also the whole paters of creating memmory space writing payload to it then later executing the thread wont all be beacons in itself for any av solutions can threadless injection be done to maybe a process and execution be done through some Nt function ???

  • @firosiam7786
    @firosiam7786 15 дней назад

    What is the best way to obfuscate shellcodes i know most would get flagged but just asking to knw some best ways to obfuscate shellcode

  • @AlienCode-ss
    @AlienCode-ss 23 дня назад

    Great series! It will be a valuable resource for new malware developer learners. As you suggested in one of the comments, prerequisites like learning X64Dbg and Windbg are important. Could you suggest some good online learning materials on these topics? Additionally, could you please create a video from a new learner’s perspective, (or might be this is first video showing a trailer for a larger series).

  • @alexhichamk6630
    @alexhichamk6630 29 дней назад

    great video sir all the best we are waiting more videos

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Месяц назад

    awsome video sir the quality of content is top notch

  • @user-uj4nq6gq5p
    @user-uj4nq6gq5p Месяц назад

    i was playing hamster kombat and my vpn get me this malware notificition and wont let me open hamster kombat , do they have it ?? :/:/

  • @disrael2101
    @disrael2101 Месяц назад

    thanks but im not a windows fan can you make it for mac / ios / android?

  • @ranger5280
    @ranger5280 Месяц назад

    Hello Ahmed, you said in the video that you have have your GitHub links to the source code in the video description, I do not see it. Could you please post it so we can review the code? Thanks

    • @ahmedskasmani
      @ahmedskasmani Месяц назад

      I am setting up a discord server where I will provide the code and answer questions related to the codes as well. Should be done this week.

    • @ranger5280
      @ranger5280 Месяц назад

      @@ahmedskasmani Sounds good; looking forward to joining

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Месяц назад

    could u please launch a course in udemy also for malware dev as itll be kind of cheaper and available for a many people who cant afford the 100's of dollars worth course

    • @ahmedskasmani
      @ahmedskasmani Месяц назад

      Let me think about it.

    • @user-wp5en1lt8r
      @user-wp5en1lt8r Месяц назад

      @@ahmedskasmani im telling that from india we dont make that much money and udemy makes a regional price parity comapred to the GDP of the country you are in many more student can learn this if it would be like that thanks for considering it hope it does happen at some point in time

    • @disrael2101
      @disrael2101 Месяц назад

      @@ahmedskasmani +1 i'll buy it also but make it comprehensive for rev eng any app out there please

  • @chhachhiawan
    @chhachhiawan Месяц назад

    Kindly make a separate playlist for this series.

    • @ahmedskasmani
      @ahmedskasmani Месяц назад

      ruclips.net/p/PLXlzLNcZf2-8RnKqZIYYetIuG7rnUmYz-

  • @oldgamerZone
    @oldgamerZone Месяц назад

    Great job man!

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Месяц назад

    now waiting for the next video in this series sir so far loving this series wish i could have joined the course you have on maldev but its way out of my budget so following along here next time could u do a mini malware dev course for Udemy as it will kind of ensure a GDP based pricing for people from different countries around the world

  • @alexhichamk6630
    @alexhichamk6630 Месяц назад

    Thank you sir, all the best

  • @kumaranshuman4227
    @kumaranshuman4227 Месяц назад

    Awesome video

  • @rastakitten
    @rastakitten Месяц назад

    Just a noob question: why would you add logging feature in your malware?

    • @ahmedskasmani
      @ahmedskasmani Месяц назад

      Good Question, so the way logging is implemented is such that if u want to debug something it can be done, and when ur releasing it u can disable the logging.

  • @imranthoufeeque165
    @imranthoufeeque165 Месяц назад

    Assalamualaikum... Kindly make a playlist of this please.

    • @rlynotabot
      @rlynotabot Месяц назад

      aleikumsalam, kindly make it yourself when he'll post the next ones ;)

    • @imranthoufeeque165
      @imranthoufeeque165 Месяц назад

      @@rlynotabot ha ha ha... I am ok to make if he gives me the creds 😂😂😂😂

    • @rlynotabot
      @rlynotabot Месяц назад

      @@imranthoufeeque165 lol you must be trolling right ? . The brother gives you free knowledge and all you have to do is clicking a button to create a youtube playlist and tou still want the creds ? You must be knew

    • @imranthoufeeque165
      @imranthoufeeque165 Месяц назад

      @@rlynotabot No bro i appreciate what he is doing... I am not sure if I can make a playlist of his content in his channel itself.. As per my knowledge they only have to create a playlist... If its not included under the playlist it will scattered..

    • @rlynotabot
      @rlynotabot Месяц назад

      @@imranthoufeeque165 Trust me bro you can do it ! lol . Go to the watch page of a video that you want in your playlist. Below the video, tap Save . Tap Create new playlist . Enter a playlist name. Use the box to select your playlist's privacy setting. If it's private, only you can view the playlist. Tap CREATE. I created countless playlist like that, Malware, Cheats, reverse enginering, HArdware hacking , SDR etc...

  • @elliot-hacks
    @elliot-hacks Месяц назад

    Impressive demonstration 🙏, I'm always excited with malwares

  • @geeksuperstar8564
    @geeksuperstar8564 Месяц назад

    Great content. I wish you had playlists for your different topics to make it easier to follow them.

  • @aironmanDiver
    @aironmanDiver Месяц назад

    Hi ! From a point of view , it is fun to learn this techniques, but it exists a responsibility to tech the way to prevent and fix this malware

  • @alexhichamk6630
    @alexhichamk6630 Месяц назад

    Hell Mr Ahmed, Inchaa Allah you are in good health, thank you for these great videos can you please make an introduction video for the beginners in malware dev, like the languages we need to learn and so on Thank you very much

  • @user-wp5en1lt8r
    @user-wp5en1lt8r Месяц назад

    greatfull for you to start this series, im from india and could not afford many courses out there which are worth 100s of dollars to learn mal dev hopefully this series continues in a timely manner and many people from different parts of the world could learn these techniques

  • @mohsinhafeez
    @mohsinhafeez Месяц назад

    thank you!

  • @lofi_spirit
    @lofi_spirit 2 месяца назад

    sir, i am gettig this error : error : " [+] Setting password to never expire to avoid that a password expiration blocks the installation... Set-LocalUser : The term 'Set-LocalUser' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At D:\flare-vm-main\flare-vm-main\install.ps1:318 char:5 + Set-LocalUser -Name "${Env:UserName}" -PasswordNeverExpires $tru ... + ~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Set-LocalUser:String) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : CommandNotFoundException " AND also showing a warning that we are not running it in virtual machine so will it affect our system?

  • @zyadelzyat
    @zyadelzyat 2 месяца назад

    great work ❤ may i ask if i want to make a script to resolve those hashes at once what can i do ?

  • @MalwareHunter_07
    @MalwareHunter_07 2 месяца назад

    hey great explanation but i wanted to know whats the final payload dll have impact on the system? or just a sideloading

  • @arizvisa
    @arizvisa 2 месяца назад

    setting operands to enum, and renaming frame members is something that you should also be scripting.

    • @ahmedskasmani
      @ahmedskasmani 2 месяца назад

      Good point. I was being lazy about it :)

  • @bilalsiddiqui9341
    @bilalsiddiqui9341 2 месяца назад

    brilliant. i love how you make something so detailed, like reverse engineering/malware analysis, seem so straightforward and clear. hope to see more vids in the future until i can afford the course!

  • @MalwareHunter_07
    @MalwareHunter_07 2 месяца назад

    make one video on blackmatter & lockbit ransomware analysis

  • @user-wp5en1lt8r
    @user-wp5en1lt8r 2 месяца назад

    could you do a video on how someone could look for malware if he has doubt wether his system is infected or not

  • @mohamedlmad
    @mohamedlmad 2 месяца назад

    goooood

  • @bhumiputra6108
    @bhumiputra6108 2 месяца назад

    Eagerly waiting for your next video

  • @Edison-newworldBlogspot
    @Edison-newworldBlogspot 2 месяца назад

    Super analysis

  • @bilalsiddiqui9341
    @bilalsiddiqui9341 2 месяца назад

    awesome!

  • @babbalaminou5956
    @babbalaminou5956 2 месяца назад

    Great work

  • @MalwareHunter_07
    @MalwareHunter_07 3 месяца назад

    elastic search service stopping after a while? any solution

  • @MalwareHunter_07
    @MalwareHunter_07 3 месяца назад

    you have changed the ip address is it ubuntu ip right?

  • @R3v0ult
    @R3v0ult 3 месяца назад

    brilliant video

  • @disrael2101
    @disrael2101 4 месяца назад

    great sounds amazing.. what about mac / linux / ios / android similar course? as i'm not a windows fan e.g. pegasus

  • @rizwanmehboob4725
    @rizwanmehboob4725 4 месяца назад

    Great work as always. The syllabus is indeed in-depth and full of advance topics. Note taking during a course is always painful and notion is looking promising. Thank you for sharing.

  • @moinkhokhar1897
    @moinkhokhar1897 4 месяца назад

    🎉🎉🎉🎉🎉🎉

  • @rafaellee711
    @rafaellee711 5 месяцев назад

    Hi, is there a download link for agent tesla? :)

    • @ahmedskasmani
      @ahmedskasmani 5 месяцев назад

      The hashes are the description just search for the hashes on Malware Bazaar. Google/Bing is ur friend.

  • @system62_
    @system62_ 6 месяцев назад

    Thanks You sir

  • @WatsonInfosec
    @WatsonInfosec 6 месяцев назад

    Found this link on LinkedIn and enjoyed it. My only issue is that Elastic has not written code to generate Binary files for fleet agent installs. It's a really good product but no development on that side.

  • @kaiden3514
    @kaiden3514 7 месяцев назад

    *promo sm* 🤩

  • @OrlandoF654
    @OrlandoF654 7 месяцев назад

    Is the Ghidra installation and usage part of your course?

    • @ahmedskasmani
      @ahmedskasmani 7 месяцев назад

      Yes, all static analysis is done in ghidra.

  • @opmfa1850
    @opmfa1850 7 месяцев назад

    how to activate dark mode in ghidra??

    • @ahmedskasmani
      @ahmedskasmani 7 месяцев назад

      my video shows how to do it: ruclips.net/video/debaKMGM78E/видео.htmlsi=AAKwG71ooDQSJ8wL

  • @shrooms1219
    @shrooms1219 7 месяцев назад

    what is the hardware compatibility of your vmware? it is pretty slow on vmware17.0

    • @ahmedskasmani
      @ahmedskasmani 7 месяцев назад

      Make sure you disable side channel mitigations in the advanced settings in vm setting menu.