Hermes Ransomware Decrypted in Live Video by Emsisoft's Fabian Wosar

[Solarquest]

Emsisoft CTO and Malware Researcher Fabian Wosar has stated in the past that he wanted to perform an educational live stream about reversing malware. Today, after GDaata security researcher Karsten Hahn discovered a new ransomware called Hermes, Fabian decided to use it as the sample for his first live streaming session.

The best part of it is that it turns out that this ransomware was able to be decrypted. This allowed those of us who were watching the live stream to get a first hand view of how a malware researcher analyzes and creates a decryptor for a new ransomware.

Fabian's Analysis shows that Hermes can be Decrypted
While analyzing the Hermes sample, Fabian found that the seed used to generate the encryption key could be attacked in order to create a decryptor. Once this was determined, Fabian displayed how this knowledge could be used to generate a key and a subsequent decryptor for encrypted files.

For those interested in this process, you can watch the full video, which is embedded below. I watched a good portion of the live stream today and it is an interesting way to gain a better insight as to how researchers analyze malware.

More details in the link above

 

[WinXPert]

Dang! Video is private

 

[reboot]

Dang! Video is private

Yes it is coming up private for me also.

@Solarquest you mentioned that it is "embedded below" did you mean on MT?

 

[Solarquest]

It should be available on the link above but unfortunately it's private....

 

[erreale]

Works for me...

Also it works for me

 

[Solarquest]

Now it works!

 

[Wingman]

I have to login to "confirm my age" ???lol

 

[vemn]

I have to login to "confirm my age" ???lol

Nudity content. They are stripping Hermes.R.

 

[Ink]

Yes it is coming up private for me also.

@Solarquest you mentioned that it is "embedded below" did you mean on MT?

It's text is a copy and pasted from Source.
Video may not be viewable from mobile, try from embedded video at BleepingComputer or Desktop mode using browser.

Works from Chrome for Android, in Desktop mode.

 

[Wave]

Heads up, the video is a dozen hours long. I watched a bit live but it was going on for so long so I took a break and missed a lot of what went on, but it was still a good live stream and there's no denying that Fabian is good at what he does (e.g. malware analysis) and has a lot of experience it

Hopefully one day I can be on the level he is on now but it might take another 100 years haha