HuskyHacks
HuskyHacks
  • Видео 39
  • Просмотров 308 289
decompile the halls | TryHackMe Advent of Cyber 2023 Day 9 [Malware Analysis]
Ayo as a side note, I teach malware analysis professionally over at TCM Security Academy! I run a 9+ hour course called Practical Malware Analysis & Triage which covers this subject and many others. Check it out over there if you're interested!
AND... the first 5 hours of that course are on RUclips for free! Check it out here: ruclips.net/video/qA0YcYMRWyI/видео.html
Practical Malware Analysis & Triage: academy.tcm-sec.com/p/practical-malware-analysis-triage
00:00-06:00 - intro, story background, malware analysis concepts, .NET and decompilation
06:00-07:10 - loading sample into dnSpy, examining the decompiled code
07:10- 08:10 - briefly covering C2 architecture
08:10-16:00 - analyzing the dec...
Просмотров: 15 406

Видео

we are so-ho-ho back | TryHackMe Advent of Cyber 2023 Day 2 [Python + Jupyter Notebooks]
Просмотров 23 тыс.9 месяцев назад
00:00-00:45 - ya boi is back. intro. 00:45-05:19 - exposition, Python, Jupyter notebooks, background 05:19-16:00 - Notebook 1: Intro to Python/Jupyter notebooks, data types, variables, type inference, running cells, markdown 16:00-23:50 - Notebook 2: Intro to Pandas, dataframes, series, simple data manipulations 23:50-27:25 - Notebook 3: Intro to Matplotlib, making graphs from dataframes 27:25-...
I, Too, Stole a Microsoft 365 Account. Here's How. (Stealing Access Tokens from Office Desktop Apps)
Просмотров 7 тыс.9 месяцев назад
Attacking & Defending Azure & M365 - Xintra Training: training.xintra.org/view/courses/attacking-and-defending-azure-m365 mrd0x original writeup: mrd0x.com/stealing-tokens-from-office-applications/ TokenFinder: github.com/doredry/TokenFinder I also reimplemented TokenFinder in C#: github.com/HuskyHacks/SharpTokenFinder
Malware C2 Keying! Speakfriend | Huntress 2023 Capture the Flag
Просмотров 50210 месяцев назад
Malware C2 Keying! Speakfriend | Huntress 2023 Capture the Flag
breaking WEAK ENCRYPTION. BlackCat Walkthrough | Huntress 2023 Capture the Flag
Просмотров 38610 месяцев назад
breaking WEAK ENCRYPTION. BlackCat Walkthrough | Huntress 2023 Capture the Flag
c r a b | Crab Rave Walkthrough | Huntress 2023 Capture the Flag
Просмотров 35810 месяцев назад
Responsible Red Teaming: taggartinstitute.org/p/responsible-red-teaming
this computer READS YOUR MIND. Rock, Paper, Psychic | Huntress 2023 CTF
Просмотров 44910 месяцев назад
this computer READS YOUR MIND. Rock, Paper, Psychic | Huntress 2023 CTF
PyArmor Malware! Snake Eater Walkthrough | Huntress Capture The Flag 2023
Просмотров 70710 месяцев назад
PyArmor Malware! Snake Eater Walkthrough | Huntress Capture The Flag 2023
he back and he MAD 💢 Black Cat II Walkthrough | Huntress 2023 Capture the Flag
Просмотров 30310 месяцев назад
he back and he MAD 💢 Black Cat II Walkthrough | Huntress 2023 Capture the Flag
don't call it a comeback. Snake Eater II Walkthrough | Huntress 2023 Capture the Flag
Просмотров 32110 месяцев назад
don't call it a comeback. Snake Eater II Walkthrough | Huntress 2023 Capture the Flag
Cloudy with a Chance of Malware: Moving Malware Analysis to the Cloud
Просмотров 2 тыс.11 месяцев назад
Presented to the Cloud Security Alliance of LA/SoCal
It was sublime. Husky Hikes the AT 2023 (Finale)
Просмотров 423Год назад
It was sublime. Husky Hikes the AT 2023 (Finale)
I. Do. Not. Yield!!! - Husky Hikes the AT 2023 (Part 14)
Просмотров 245Год назад
I. Do. Not. Yield!!! - Husky Hikes the AT 2023 (Part 14)
We Crushed the White Mountains* (*they crushed us back tho) | Husky Hikes the AT 2023 (Part 13)
Просмотров 169Год назад
We Crushed the White Mountains* (*they crushed us back tho) | Husky Hikes the AT 2023 (Part 13)
POV: you’re hiking the hardest mile on the Appalachian Trail - Husky Hikes the AT 2023 (Bonus!)
Просмотров 418Год назад
POV: you’re hiking the hardest mile on the Appalachian Trail - Husky Hikes the AT 2023 (Bonus!)
relaxing Appalachian Trail content from CT, MA, & VT 😌 - Husky Hikes the AT 2023 (Part 12)
Просмотров 190Год назад
relaxing Appalachian Trail content from CT, MA, & VT 😌 - Husky Hikes the AT 2023 (Part 12)
A hidden gem beach | Manhattan Skyline | Retracing Steps - Husky Hikes the AT 2023 (Part 11)
Просмотров 209Год назад
A hidden gem beach | Manhattan Skyline | Retracing Steps - Husky Hikes the AT 2023 (Part 11)
The… other part of PA. New Jersey is actually gorgeous - Husky Hikes the AT 2023 (Part 10)
Просмотров 181Год назад
The… other part of PA. New Jersey is actually gorgeous - Husky Hikes the AT 2023 (Part 10)
Halfway Point. 🦝 Raccoon Raid. The Good Part of PA- Husky Hikes the AT 2023 (Part 9)
Просмотров 195Год назад
Halfway Point. 🦝 Raccoon Raid. The Good Part of PA- Husky Hikes the AT 2023 (Part 9)
Virginia Blues & Shenandoah Views - Husky Hikes the AT 2023 (Part 8)
Просмотров 208Год назад
Virginia Blues & Shenandoah Views - Husky Hikes the AT 2023 (Part 8)
…and goats. Husky Hikes the AT 2023 (Part 7)
Просмотров 226Год назад
…and goats. Husky Hikes the AT 2023 (Part 7)
ponies. Husky Hikes the AT 2023 (Part 6)
Просмотров 209Год назад
ponies. Husky Hikes the AT 2023 (Part 6)
Achievement Unlocked: Marathon Man - Husky Hikes the AT 2023 (Part 5)
Просмотров 229Год назад
Achievement Unlocked: Marathon Man - Husky Hikes the AT 2023 (Part 5)
The Roan Mountain Gambit - Husky Hikes the AT 2023 (Part 4)
Просмотров 374Год назад
The Roan Mountain Gambit - Husky Hikes the AT 2023 (Part 4)
My hat goes off to Big Bald. Literally - Husky Hikes the AT 2023 (Part 3)
Просмотров 322Год назад
My hat goes off to Big Bald. Literally - Husky Hikes the AT 2023 (Part 3)
A brush with injury - Husky Hikes the AT 2023 (Part 2)
Просмотров 320Год назад
A brush with injury - Husky Hikes the AT 2023 (Part 2)
The hardest part is over - Husky Hikes the AT 2023 (Part 1)
Просмотров 622Год назад
The hardest part is over - Husky Hikes the AT 2023 (Part 1)
GAZELLEKIT - My AT 2023 NOBO Gear Kit
Просмотров 356Год назад
GAZELLEKIT - My AT 2023 NOBO Gear Kit
i'm leaving.
Просмотров 2,4 тыс.Год назад
i'm leaving.
a bold offensive, a daring escape (4K)
Просмотров 1,2 тыс.Год назад
a bold offensive, a daring escape (4K)

Комментарии

  • @niless577
    @niless577 Месяц назад

    It was an amazing and helpful tutorial for beginner malware analiyst. Thank you so much, I was searching something like this and your content is exactly what I was looking on the internet. Thank you again🤗

  • @queenhannah8007
    @queenhannah8007 Месяц назад

    What if we have the access token

  • @NewbieValorantYT
    @NewbieValorantYT Месяц назад

    is it ok to enable the clipboard share feature on flarevm ?

  • @Robalo450
    @Robalo450 Месяц назад

    How do you get PEView?

  • @EliteBuildingCompany
    @EliteBuildingCompany Месяц назад

    I was struggling with the very last part finding the phpinfo file, danke.

  • @rasperss_5176
    @rasperss_5176 Месяц назад

    One tip, personally I would go the extra step and by ensuring clipboard sharing is disabled when deploying malware. I don't think he mentioned that and did notice he had it enabled when copying hashes to virus[.]total just my two cents. But great video none the less!

    • @slicknick77
      @slicknick77 17 дней назад

      It looks like Flare VM already defaults to disabling the clipboard

  • @114thp7
    @114thp7 2 месяца назад

    Hi, mr Husky. I have a little bit problem. As you showed at 59:09 to run wannacry then try it in my flare VM but wannacry.exe didn't run. I wonder why this happened(defender was off) Thanks in advance

    • @mattanderson2074
      @mattanderson2074 2 месяца назад

      You probably have the same issue as me - using a Windows 10 build which is no longer vulnerable to wannacry.

    • @114thp7
      @114thp7 2 месяца назад

      @@mattanderson2074 i dont know why, but it worked. Wannacry works properly

  • @arturcorreia6615
    @arturcorreia6615 3 месяца назад

    Windows Defender is not letting me detonate de virus :(

  • @luckbeforeleap
    @luckbeforeleap 3 месяца назад

    Dumping the access tokens is nice but dumping the refresh tokens would be cooler :)

  • @hyphen686
    @hyphen686 4 месяца назад

    Can you show the same lab setup using VMware Workstation Pro? I haven't been able to find a single video on this topic.

    • @slicknick77
      @slicknick77 17 дней назад

      that's paid for. You can either use VMWare player or VirtualBox for free.

    • @hyphen686
      @hyphen686 17 дней назад

      @@slicknick77 yeah i can intall them in VMWare player, but still struggling in isolating them. it is not the same as VirtualBox.

    • @slicknick77
      @slicknick77 17 дней назад

      @@hyphen686 so you’re talking about the network settings in vmware? I’d honestly throw it into ChatGPT and that should get you to a fixed spot

  • @Conspiranoiiico
    @Conspiranoiiico 4 месяца назад

    A file can perform certain checks on the system before downloading and executing the final malware, such as checking if the system is a virtual machine, for example by looking for this registry key: *HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools* I think that all possible traces of virtualization must be eliminated

  • @user-ut5vf7qy5o
    @user-ut5vf7qy5o 4 месяца назад

    I am still a beginner, how to install the files to my flare vm and I have no connection to the internet ?

    • @muhammedbadawy1543
      @muhammedbadawy1543 2 месяца назад

      You download it into your main machine then enable drag and drop (host to guest) and transfer the files into the Flare VM

  • @haneesha3548
    @haneesha3548 4 месяца назад

    i cannot find the flare-vm github repo

  • @TheRikkieg
    @TheRikkieg 4 месяца назад

    Thanks! The information about the jwt token helped me find a big vulnerability

  • @johnvardy9559
    @johnvardy9559 4 месяца назад

    I Just found you , and you have great Content. Im trying to learn some stuff, how to be soc Analyst?

  • @KothariHitarth
    @KothariHitarth 4 месяца назад

    Can you make a video by testing the any malware in kali Linux , I mean whole malware analysis on kali Linux with Linux tools .

  • @sagartimalsina4120
    @sagartimalsina4120 4 месяца назад

    Just a quick question.. why does my Network setting is not working? I tried everything but the configuration is just not working in my case? Any solution?

  • @043-namanvora2
    @043-namanvora2 5 месяцев назад

    hey husky i tried to download the repo on my physical host but the defender and browser didn't let me download the repo as it was detection viruses into it can you help me with it please

    • @OldDirtyDragon
      @OldDirtyDragon 5 месяцев назад

      Same issue. Best I can find, the latest version of Win10 does not allow users to disable MsMpEng.exe. It is owned by the system. That's Microsoft's main AV scanner. Have not found a way around it yet.

    • @043-namanvora2
      @043-namanvora2 5 месяцев назад

      @@OldDirtyDragon well bro it is a very simple issue what i did that i cloned the repo using git clone command and further it was downloaded on the pc but i made sure i dont open or unzip the repo, i further enabled the drag n drop from host to machine option temporarily for flarevm after dropping the repo into the flarevm i disabled the drag n drop option from v box and made sure that i have deleted the cloned repo from my physical machine and during all this process i didn't touched or twitch the windows defender should work for you as well

  • @sambhavjain6929
    @sambhavjain6929 5 месяцев назад

    5:02 5:03 5:05

  • @hydradragonantivirus
    @hydradragonantivirus 6 месяцев назад

    Malware analysis didn't work anymore.

  • @repairstudio4940
    @repairstudio4940 6 месяцев назад

    This has been such an amazing journey. Much respect to Husky! Heath's crew @ TCM are awesome! 🎉

  • @repairstudio4940
    @repairstudio4940 6 месяцев назад

    Man thank you this has been amazing. Liked and Subbed and going to recommend your channel. 💙💻🦠😎

  • @user-jv6pq8uj2t
    @user-jv6pq8uj2t 6 месяцев назад

    Thank you very much for this video, can I get your mail id so that can discuss which are related to this in details. Am a PhD student and faculty in an organization, my work on this is very interesting.

  • @FRITTY12348546
    @FRITTY12348546 6 месяцев назад

    I enjoyed these! thanks for writing them coming back now to see the ones I missed

  • @piyushgayaki9667
    @piyushgayaki9667 6 месяцев назад

    Thanks a lot sir. Just what to know for after ransomware detonation which tools I can use for dynamic analysis like you have shown how to use procmon and procexp but when I detonate the ransomware tools get crash.

  • @user-tx4jq9gc4n
    @user-tx4jq9gc4n 6 месяцев назад

    I swear to God, This is very good malware analysis for real, I will recommend to my folks, HuskyHacks, Thank you for everything

  • @atikullah9066
    @atikullah9066 6 месяцев назад

    best malware analysis course. Thanks for this amazing course

  • @user-up7yn5eg5f
    @user-up7yn5eg5f 6 месяцев назад

    floss cmmand not working in my cmd said that it is not recognizeble how to solve this issue

  • @user-xn5cu3bg8r
    @user-xn5cu3bg8r 6 месяцев назад

    hello

  • @user-xn5cu3bg8r
    @user-xn5cu3bg8r 6 месяцев назад

    Hello Sir, I am facing one issue, whenever I try to arm any binary, win10 defender or firewall removes it, Although all security options are turned off, Via Real Time Protection, Registry entry, group security policy etc. Still whenever any binary is converted to armed mode, windows automatically removes it. Kindly help what to do?

  • @user-up7yn5eg5f
    @user-up7yn5eg5f 6 месяцев назад

    In remnux when i mount it said no medium found on dev/sro what i can do for these

    • @slicknick77
      @slicknick77 18 дней назад

      Go to devices>insert guest additions cd image... >run

  • @nicksunny100
    @nicksunny100 7 месяцев назад

    Subscribed!!

  • @nelsoncorreia7293
    @nelsoncorreia7293 7 месяцев назад

    Decided to run through AoC 2022 after doing the 2023 version because I found it very informative. I got stuck on one question and this helped me out. Thanks.

  • @Hanacan75
    @Hanacan75 7 месяцев назад

    Thank you my friend. Excelent tutorial :) I'm cheering for you to do more. hhaha

  • @ninjaspeedone
    @ninjaspeedone 7 месяцев назад

    When I try to mount the cdrom I get this error message, mount: /media/cdrom: no medium found on /dev/sr0.

    • @amirahabubakar3277
      @amirahabubakar3277 4 месяца назад

      Go to devices>insert guest additions cd image... >run

  • @philosphize
    @philosphize 7 месяцев назад

    Thank you so much for this amazing tutorial Please release next set of malware analysis video

  • @dheerkv9098
    @dheerkv9098 8 месяцев назад

    Hi @huskyhacks ! Thank you for sharing the video. I am unable to get Fireeye Flare-vm, it it mandiant/Flare-vm ?

    • @huskyhacks
      @huskyhacks 8 месяцев назад

      Yes, it's now hosted under the Mandiant org on GitHub

  • @buzgie
    @buzgie 8 месяцев назад

    listening to all the safety spiels as a linux user is funny. I have a habit of just leaving malware .exes lying around my pc because it can't do anything aha

  • @cyberus15
    @cyberus15 8 месяцев назад

    Doesn't work. even with renewed token it errors out: {"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError....

    • @huskyhacks
      @huskyhacks 8 месяцев назад

      What's the audience for that token and which resource are you trying to access?

    • @cyberus15
      @cyberus15 8 месяцев назад

      Not sure about the audience, but the token is for outlook for sure.

    • @huskyhacks
      @huskyhacks 8 месяцев назад

      @@cyberus15 Unfortunately, the Outlook API was deprecated sometime last year learn.microsoft.com/en-us/previous-versions/office/office-365-api/api/version-2.0/use-outlook-rest-api You might be able to get lucky and find an older on-prem Exchange server that still uses the API but I haven't tested that. Your best bet is to hunt for Graph API tokens and use those

  • @MAX-nv6yj
    @MAX-nv6yj 8 месяцев назад

    Nice video man this was fun to watch <3

  • @samihakonen8193
    @samihakonen8193 8 месяцев назад

    Why is there no shared clipboard in this machine? It's just poor execution to force people to write everything to the answer boxes.

  • @sydneywoods4980
    @sydneywoods4980 8 месяцев назад

    Thank you for the extremely informative intro to Jupyter Notebooks!

  • @TheVio888
    @TheVio888 8 месяцев назад

    You have a new subscriber through Advent of Cyber 2023. Thank for your eloquent presentation.

  • @konradwerner4134
    @konradwerner4134 8 месяцев назад

    when run, it says "pd is not define"

  • @akshay.c4544
    @akshay.c4544 9 месяцев назад

    It was really good..there’s a small doubt that in this we are using get and post methods, is it using for getting information and instruction from c2 server/giving the data to the c2 server..there’s a bit of confusion in that 9:57

  • @secops3531
    @secops3531 9 месяцев назад

    Unbelievable how clear your explanations are, I appreciate you doing this - thank you!

  • @swiftrouge3231
    @swiftrouge3231 9 месяцев назад

    okayyyy, fun and interesting. learned something new despite needed my hand held 😂😂

  • @samikhaledalruje
    @samikhaledalruje 9 месяцев назад

    Very informative explanation, Thank you brother ^___^

  • @TheBeeman410
    @TheBeeman410 9 месяцев назад

    Thanks man!!!

  • @brandona6282
    @brandona6282 9 месяцев назад

    Great explanation and a great tool to have in the bag!