Advanced Ransomware Reverse Engineering

Reverse engineering. Advanced Debugging, Obfuscations and Anti-Analysis. Writing decryptors

Created by: Cristina Gheorghisan
Trainer and Coach

What Will I Learn?

• This course is a continuation of our first class, Reverse Engineering Malware, but don’t worry, that is not a pre-requisite.
• Identify and work around anti-virtualisation techniques deployed inside malware samples
• Dynamic analysis of sample’s activity on a Windows box
• Advanced debugging techniques
• Use static analysis to discover and understand encryption algorithms
• Discover, and work-around, obfuscation tricks and anti-static analysis tricks
• Discover flaws that allow us to recover encrypted files
• Write decryptors in Python and C
• Patience and a lot of perseverance to “try harder”

Requirements

• A computer that can run a Windows virtual machine.
• An interest in disassembling things and understanding how they work!
• Basic assembly knowledge about common instructions, registers, conditional branches
• Basic programming knowledge and ability to understand simple Python and C source code

Target audience

• Security testers
• Malware analysts
• Forensics investigators
• System administrators
• Information security students