Главная
Study mode:
on
1
Finding the image_base
2
Parsing the image dos header
3
DATA Directories
4
The IMAGE_EXPORT_DIRECTORY
5
AddressOf*
6
Checksum from a DLL name - where the seeds come from
7
Brief note on the UNICODE structure
Description:
Explore the intricacies of Lockbit's runtime-linking technique in this 14-minute video tutorial. Delve into how Lockbit utilizes the DLL name as a seed for API hashing, a unique twist on standard malware techniques. Learn to identify the image_base, parse the image DOS header, and understand DATA Directories. Examine the IMAGE_EXPORT_DIRECTORY and AddressOf* functions. Discover how the DLL name generates checksums that serve as seeds for API name computation. Gain insights into the UNICODE structure and its relevance. Enhance your reverse engineering skills and grasp the broader implications of these techniques on malware analysis efforts.

Lockbit's DLL Name Seeding Technique for API Hashing - Part 5

Dr Josh Stroschein
Add to list