How I Execute Malicious Services

In this video, I share an approach to analyzing a malicious service executable.
Please subscribe to the channel to get notified about upcoming malware analysis / reverse engineering videos.
Sample: github.com/as0...
Password: infected
Malware Family: Cobalt Strike
Tools
Ghidra: ghidra-sre.org/
pestudio: www.winitor.co...
CFF Explorer: ntcore.com/?pa...
Find Anuj Soni on Twitter: / asoni
Connect on LinkedIn: / sonianuj
SANS Malware Analysis Courses I Author and Teach:
sans.org/for610 (co-author with Lenny Zeltser)
sans.org/for710
Please leave a comment to let me know what other topics you would like me to cover.

[@PaoloPerego]

Hi Anuj, my topic area is far from malware analysis but you're content is so clear and understandable. Thumbs up

[@sonianuj]

Thank you for the feedback!

[@KenPryor]

This was excellent! I'm looking forward to future videos from you. I've done basic stuff with malware for years, but never learned much beyond the basics.

[@sonianuj]

Awesome, more to come!

[@user-en1sx9ig4u]

VERY HELPFUL video!!!! Thank you

[@forensicmike175]

Hey Anuj! Great video. The ghidra dragon roar 😂😂. Keep up the good work!

[@sonianuj]

Lol thanks!

[@cyrussecurity]

Really enjoyed this video and the length/breakdown of it.

[@sonianuj]

Appreciate that feedback! Thanks for watching.

[@cyrussecurity]

@@sonianuj would love more content around the annoying things malware does (encoding, junk code, etc.) and how you navigate them to get to the core analysis you're trying to do 😃

[@venkateshs3286]

Well edited OfCourse when the Ghidra is opened and would like to see more videos on Dynamic Malware analysis.

[@sonianuj]

Great to know, thanks for the suggestion!

[@naimulislam1263]

Thanks for sharing the golden nuggets :'D

[@sonianuj]

Thanks for watching!

[@nealjenkins4647]

More please using the same setup (610&710 VMs).
Great video. Thank you.

[@sonianuj]

Thanks for watching!

[@empise_]

Awesome content and explanations, please continue with uploads 😁

[@sonianuj]

Thank you! Will do!

[@SejTuSe]

7:14 just wondering why there is pushed same register EDX twice?
00401b37 PUSH EDX
00401b38 PUSH EDX

[@1337BR3AK]

let's goooo

[@ghoulism6522]

great video

[@sonianuj]

Thanks for watching!

[@cyphercat.itat40]

This isn't IT/cybersec related, but what brand of shirt is that?

[@sonianuj]

cutsclothing.com, my go-to!

[@RommelRamos1002]

Hey Anuj, This is great !! How's it going? :D

[@sonianuj]

Thanks Rommel! It’s great to hear from you. Hope you’re doing well!

[@johnvardy9559]

How i become Soc analyst?

[@sonianuj]

Hi! Unfortunately I’m not the best person to answer this question (I’ve never been a soc analyst).

[@johnvardy9559]

@@sonianuj why and what I have to do??? 😕