Главная
Study mode:
on
1
Intro
2
About This Talk
3
Dynamic Analysis Intro
4
Process Explorer
5
Process Monitor
6
INetSim + Wireshark
7
Debugger Video
8
Static Analysis
9
PE Studio
10
010 Editor Templates
11
Types of Malware Armor
12
Detecting Virtualization Artifacts
13
Virtual Mac Address Detection
14
Emotet Anti-Virtualization - Kaspersky
15
IDA Script to Highlight Anti-VM Instructions
16
How do we bypass Anti-VM
17
Anti-Debugging
18
Timing Checks
19
Thread Local Storage (TLS) Callbacks
20
Anti-Disassembly
21
Two Types of Disassemblers
22
Breaking Your Disassembler
23
Interactive Disassembler
24
Shiva Anti-RE
25
Shiva RE Redefined
26
Veil Framework
27
Obfuscation
28
XOR
29
Cryptography
30
Top Packers
31
Unpacking Tools
32
Memory Collection
33
Yara - "pattern matching swiss knife"
34
Conclusion
35
References
36
FIDELIS
Description:
Explore dynamic and static malware analysis techniques in this 46-minute conference talk from Circle City Con 2015. Dive into tools like Process Explorer, Process Monitor, INetSim, Wireshark, and debuggers for dynamic analysis. Learn about static analysis using PE Studio and 010 Editor Templates. Discover various types of malware armor, including anti-virtualization, anti-debugging, and anti-disassembly techniques. Understand how to detect virtualization artifacts, bypass anti-VM measures, and handle timing checks and Thread Local Storage callbacks. Examine obfuscation methods, including XOR encryption and packing. Get introduced to tools like the Veil Framework, Yara, and memory collection techniques. Gain insights into breaking disassemblers and dealing with advanced malware protection mechanisms like Shiva Anti-RE.

Malware Armor

Add to list