Reverse Engineering Ransomware

Name: Reverse Engineering Ransomware
Rating: 3.7 (79 reviews)

Static and dynamic analysis. Reverse engineering. Writing Decryptors

Created byCristina Gheorghisan

Last updated 9/2019

English

What you'll learn

The lectures, videos and other resources will provide relevant information about current malware analysis tricks
How to use disassemblers and other security tools
How to identify flaws in ransomware code or encryption logic
Practice on progressively difficult samples which illustrate different concepts each
Practice acquired knowledge via quizzes for each section
How to write simple decrpytors in a high-level language (source code provided)

Course content

3 sections • 9 lectures • 54m total length

Couse Introduction6:09
This lecture introduces the course. You will better understand why take this course and what this course is NOT and also the minimum prerequisites in order to be successful.

Green Dragon Ransomware14:12
In this lecture we discuss the ransomware analysis methodology and steps. After finishing this you will be able to practice these on your own virtual machine and test your skills at recovering encrypted files.
The sample we're going to work on is attached in a password protected archive. The password is "infected".
The IDA Pro saved database is also included.
Practice Green 1 - Find the encryption key - the hard way6:09
In this video we will reverse engineer the encryption routine and locate the key needed to recover the files.
Practice Green 2 - Find the encryption key - the easy way2:25
In this lecture we're going to use a trick derived from boolean logic and a flaw in ransomware code to force it to show us the key without any disassembling.
Practice Green 3 - Write a decryptor0:36
In this lecture we'll write a Python decryptor for the first ransomware based on the reversed encryption logic and the discovered key.
Practice Green 4 - Cryptanalysis - Break the key1:30
In this lecture we'll learn how to break the encryption algorithm without having the knowledge of the key or even its length, using logic and statistical methods.
Quiz Green Dragon

Blue Dragon Ransomware12:38
The second ransomware is similar however we'll learn a few new tricks and practice the skills from the first section.

The sample we're going to work on is attached in a password protected archive. The password is "infected".
Practice Blue 1 Analysis6:32
In this lecture we'll analyse the sample, locate the encryption routine, reverse engineer it and find the decryption key,
Practice Blue 2 Decryption4:41
In this section we'll write a Python script to decrypt the files.
Quiz Blue Dragon

Requirements

Basic programming knowledge
A computer that can run a Windows virtual machine.
An interest in disassembling things and understanding how they work!
Patience and perseverance to “try harder”.

Description

The aim of this course is to provide a practical approach to analyzing ransomware. Working with real world samples of increasing difficulty, we will:

Deep dive into identifying the encryption techniques,

Navigate through various evasion tricks used by malware writers,

Have fun discovering flaws in their logic or the implementation and

Work out automated ways to recover the affected files.

If you're already familiar with the basics and want to dive straight into advanced samples, navigate anti-virtualisation and anti-analysis tricks, and write C and Python decryptors for custom crypto algorithms, please check out our Advanced Reverse Engineering Ransomware course!

Who this course is for:

Security testers
Malware analysts
Forensics investigators
System administrators
Information security students
Anyone interested in ransomware and malware analysis

Reverse Engineering Ransomware

What you'll learn

Explore related topics

Course content

Course Introduction1 lecture • 6min

Under the hood of a simple cryptor5 lectures • 25min

More disassembling and writing decryptors3 lectures • 24min

Requirements

Description

Who this course is for: