OALabs | Analyzing Hancitor DLL Live - Let's Build A Config Extractor! @OALABS | Uploaded 3 years ago | Updated 2 hours ago
Join us as we reverse engineer the Hancitor DLL and write a config extractor for it in python. Expand for more ...
-----
OALABS DISCORD
discord.gg/6h5Bh5AMDU
OALABS PATREON
patreon.com/oalabs
OALABS TIP JAR
ko-fi.com/oalabs
OALABS GITHUB
github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
unpac.me/#
-----
Original Sample:
malware-traffic-analysis.net/2021/09/02/index.html
Unpacked Sample:
malshare.com/sample.php?action=detail&hash=39ae285d4a7436eec52ee4da032da13132cdf259768de8a0e396ad20245fe330
Python Lab-Notes:
github.com/OALabs/Lab-Notes/blob/main/Hancitor/hancitor.ipynb
----
Music / Instrumental by Aries Beats:
youtube.com/watch?v=lAVYmC8qFbE
youtube.com/watch?v=3lF8Op_3YtU
Join us as we reverse engineer the Hancitor DLL and write a config extractor for it in python. Expand for more ...
-----
OALABS DISCORD
discord.gg/6h5Bh5AMDU
OALABS PATREON
patreon.com/oalabs
OALABS TIP JAR
ko-fi.com/oalabs
OALABS GITHUB
github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
unpac.me/#
-----
Original Sample:
malware-traffic-analysis.net/2021/09/02/index.html
Unpacked Sample:
malshare.com/sample.php?action=detail&hash=39ae285d4a7436eec52ee4da032da13132cdf259768de8a0e396ad20245fe330
Python Lab-Notes:
github.com/OALabs/Lab-Notes/blob/main/Hancitor/hancitor.ipynb
----
Music / Instrumental by Aries Beats:
youtube.com/watch?v=lAVYmC8qFbE
youtube.com/watch?v=3lF8Op_3YtU
![View Disassembly and Pseudocode Windows Synchronize Side-by-Side In IDA Pro [ Patreon Unlocked ]](https://i.ytimg.com/vi/QZQyYkP4Bbg/hqdefault.jpg "View Disassembly and Pseudocode Windows Synchronize Side-by-Side In IDA Pro [ Patreon Unlocked ]
How to view disassembly and pseudocode windows side-by-side in IDA Pro. Subscribe for more tips: https://www.patreon.com/oalabs
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/")
![What The Security Industry Should Know About Reverse Engineering [ Reverse Engineering AMA ]](https://i.ytimg.com/vi/SffxAVWmbk4/hqdefault.jpg "What The Security Industry Should Know About Reverse Engineering [ Reverse Engineering AMA ]
What is one thing you wish your peers in the security industry knew about reverse engineering?
Big thanks to all the reverse engineers who helped us put this together!
Rattle (Jesko)
https://twitter.com/huettenhain
https://github.com/binref/refinery
Jordan (psifertex)
https://twitter.com/psifertex
https://binary.ninja/
Karsten
https://twitter.com/struppigel
https://www.youtube.com/c/MalwareAnalysisForHedgehogs
Drakonia
https://twitter.com/dr4k0nia
https://dr4k0nia.github.io/
C3rb3ru5
https://twitter.com/c3rb3ru5d3d53c
https://c3rb3ru5d3d53c.github.io/
Josh
https://twitter.com/jershmagersh
https://pwnage.io/
Dodo
https://twitter.com/dodo_sec
https://github.com/dodo-sec
Washi
https://twitter.com/washi_dev
https://washi.dev/
OALABS PATREON
https://www.patreon.com/oalabs
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/")
![Control Flow Flattening Obfuscation Explained Practically [ Twitch Clip ]](https://i.ytimg.com/vi/SulC2l1Dvbo/hqdefault.jpg "Control Flow Flattening Obfuscation Explained Practically [ Twitch Clip ]
Twitch Clip - A practical explanation of control flow flattening obfuscation linking the concept to actual code in IDA Pro. See more on https://www.patreon.com/oalabs
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU
OALABS PATREON
https://www.patreon.com/oalabs
Twitch
https://www.twitch.tv/oalabslive
OALABS GITHUB
https://github.com/OALabs
UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
Research notes with Deobfuscation code for IDA Pro and Dumpulator: https://research.openanalysis.net/pandora/ransomware/malware/unpacking/dumpulator/emulation/2022/03/19/pandora_ransomware.html
Sample: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b")
