Malware Analysis [Video] Malware unpacking methods and a generic unpacking approach

[struppigel]

An overview to unpacking methods, when to apply them and what generic approach to use for unpacking malware.



infographics: Infographics - Malware Analysis For Hedgehogs

Tools:

mal_unpack: Releases · hasherezade/mal_unpack
binary refinery: GitHub - binref/refinery: High Octane Triage Analysis
CyberChef: CyberChef

00:00 Intro
01:00 Five unpacking methods
03:50 Generic unpacking approach
04:17 Identification
06:10 Skim for obvious encryption
08:03 Run and Dump
08:27 Debugger and Breakpoints
11:30 Emulation and Self-Extracting Patch

 

[Trident]

It’s exceptionally complicated the unpacking

 

[Sandbox Breaker - DFIR]

That why i pack the night before