Welcome back.
We are now going to continue and we are going to do a malware analysis, so this previous analysis was
very useful if you wanted to rescue your free operating system.
Now you know where to go to delete the the malware from these locations in here somewhere.
Right.
So this is so useful for recovering from a malware attack, malware infection.
So to do the analysis we have, the thing that we saw this indicator compromised, trying to reach up
to these Eurail and sending these and coded bytes to the server.
Now, the thing that also keeps a record so we can close that now, conspiracy to kill it, you can
see that and you can just close it by closing the window.
So if anybody is in here, they locks.
If you open infinite locks here, you scroll down, you see a peek at file down here how peak face by
default will be open by a program called Wireshark.
So all you need to do is just click here and why police get far and you can analyze it.
So let's just before they start to fire and initialize.
OK, so now these are all the package which was captured by net and start as a picture file, and what
we want is the hefty tip because we saw from Phoenix just now that he was connecting to a hefty fee
so we can go up to the future.
Boxier in his TDP protocol and enter it now from the top here, you can see all the and you can see
he's posting something to the Internet.
Right.
So this is a post request.
So we can just reichling this and instantly follow Ekpe stream.
So now you reconstruct the traffic here, you can see these, the same output we saw from Venette earlier,
it is connecting to this website is priority and content.
Time is form.
It is posting this data.
It is key and is hex encoded stream.
And the response is OK and fener intercept it in traffic.
You can see it.
All right.
And so this is a clear indicator of compromise.
So now you know where he is going to.
So if you want to further analyze this, you probably can use a descriptor to decrypt these hexane clustering
to find out what it is.
So this is how you do it in a way analysis.
And, yeah, this is just an introduction to the analysis and the basic steps just like this.
So just to recap what we have done for the past three years and we have done an analysis following this,
this procedure basically in this order, and then we also the prop on settings and promote export.
And he said if you did and we saw the analysis confirming the persistence and location.
And he also did the analysis using an and ways to analyze it by following the stream.
So hope this helps you guys are there to get a basic grasp of what dynamic analysis is all about.
So now you can write the report to put in everything that he has seen in their report, will comprise
your list of all the indicators of compromise and you'll see.
So that's all for this video.
Thank you for watching.
And remember, before you you start your next session of your analysis, you should always go and restore
your snapshot for your virtual machine.
OK, so restoring your snapshot who clean up all the way from the washing machine so that you'll be
able to start afresh with a new analysis for a new malware sample.
So that's all.
Thank you.
See you in the next one.