Understanding malware
As a software engineer, I have taken for granted I'd understand a lot of how malware works. But then I also know that the devil is in the details. This lead me to a YouTube series by @lauriewired (https://www.youtube.com/@lauriewired), who is a reverse engineer and takes apart malware in full view so that viewers understand process as well as tools. She is thorough and methodical in her videos, which makes me self-conscious about the way I leapt off the trail when doing similar investigations and looked to see what was at the endpoints or URLs I found in code - without finishing to see conclusively what the goal of the malware was. I'd assume data exfiltration, without necessarily proving such and from watching @lauriewired, I see there are many variants and what I'd missed was seeing how the perpetrators were likely actually setting up to download an entire command and control piece to make a virtual slave out of the system.
Seeing malware de-obfuscated and refactored provided an in-depth view of malware from the authors point of view. It was interesting in that the code was not haphazard, but also built with a certain level of redirection that seemed to only add stack-frames to the execution, perhaps itself a level of runtime obfuscation.
Overall, I've found a number of @LaurieWired presentations informative and would recommend giving them a look.
Comments