Главная
Study mode:
on
1
Finding evidence of runtime linking
2
Precomputed hashes/checksums and what they are used for
3
Building context around how APIs will be imported
4
Another layer deeper
5
Using recursion to dynamically resolve APIs
6
Stepping through the code in a debugger
Description:
Explore the intricacies of Lockbit's runtime linking techniques in this 16-minute video tutorial. Delve into how the malware dynamically builds its import table, a crucial aspect of reverse engineering. Uncover the use of precomputed values instead of strings as an additional layer of obfuscation. Learn to identify signs of runtime linking, understand the purpose of precomputed hashes/checksums, and build context around API importation. Dive deeper into the malware's structure, examining its use of recursion for dynamic API resolution. Conclude with a practical demonstration of stepping through the code in a debugger, enhancing your malware analysis skills.

Identifying Signs of Runtime-Linking and Building Context for API Hashes in Lockbit Malware - Part 3

Dr Josh Stroschein
Add to list