Beginner Malware Reverse Engineering Stream (02-03-2024)

Throughout this stream we unpack and analyze a malware variant that performs clipboard hijacking to steal cryptocurrencies and can download and execute additional payloads. Training: https://training.invokere.com/course/imbt Unpacking script: https://github.com/Invoke-RE/x64dbg-scripts/blob/main/unpacking_apis.txt Twitch: https://www.twitch.tv/InvokeReversing Twitter: https://twitter.com/InvokeReversing Mastodon: https://infosec.exchange/@invokereversing 0:00 Intro and chatting 4:34 Filetype Identification 15:06 Exploring NSIS installer 17:41 Analyzing Packed DLL 1:08:47 Dynamic unpacking of DLL 1:26:57 Analyzing unpacked malware 1:37:31 Anti-vm functionality 1:43:14 Self-deletion 1:51:31 Registry changes 1:59:19 Worm functionality 2:29:22 Clipboard hijacking to steal crypto 2:39:55 Analyze IRC C2 functionality