Hello and welcome back.
In this video, we are going to get started with the analysis of malware sample number three, also
known as Lochaber Trojan, after you downloaded this file from the resource section, just go in and
zip it.
I try to get some poetry for the the.
He's cracking license
dot com.
He would then have a folder containing the anyway.
It is renamed the bin extension instead of the extension, in order to protect you from accidental clicks
open TriNet.
Analyze it.
And here you see he say CBl.
So we cannot get much information from here, so now we'll try to analyze it.
We've EIC.
Go to.
It is really UCSC be in for.
And it has detected it as authority program.
And authority is a tool for creating automation.
It is not Malvasia.
He's kind of popular, too, but.
He was also by some voters in order to create malware, so you can go in Googling for it to understand
more about it.
So if you search for Tity, you find this link here.
How do I describe.
It is a freeware programming language written by script.
After the script has created a script, he or she can convert it into a.
So this is what all this is like.
And now there are authors who write the authority script and then we'll convert it to an easy.
So this is what you are seeing here.
So, yes, in be also very helpfully suggests how you can decompiled this by using the two to 80.
Now, if he opened the floor for that, go to utilities and run these to you.
You can see some additional information.
So the drink fell way into studio.
And analyzed their file.
And you can see why Aristotle has detected 55 72.
Ideavirus has detected a smell of a Trojan.
Trojan Horse Authority.
Trojan spy Win32 Noki.
If you go here, you see this in right, click on it, and he hesitated as an authority Trojan.
And the Secret Service finally saw station, and they are KeyData.
So this is the location, the offset of inside the resources where the authorities creep is found.
So basically we're looking at an interpreter and authority interpreter and reading the interpreter.
So there is a resource station which contains the actual script itself.
So that is how it works.
So we can actually unpack it.
Using the suggested to buy EIC copy, which is the EIC to eighty two, so we can now run the AC 282
from the flesh utility for the look for the two EIC to 80.
So this is compiled from a duty to see.
So now we are reversing Yes to eight.
So originally it was the authority script but the writer converted into a.
So we use this to compile three Rungis now EIC two eight eight.
So just the warning here, dropping, modified or non modified to light you fast into easy to aid might
result in executions.
So be careful.
OK,
so now we take this and drop it in the compiler.
And you see a new forest being generated here that create tension.
This is the script, a strike that from there from the melee.
So we can open this or he can read it from here, the scream itself, and it is retaining VBS script.
So he's in plain text, but there's a lot of frustration.
As you can see, obfuscation is a tiny hiding the intended code.
So that makes it difficult for the analyst to understand what is going on.
You can also view this at a tree farm by right clicking and opening of her sublime texts or any text
editor of your choice.
Let's try to be cool.
Visual Studio.
Could you show you're still good?
You can view the file and scroll down.
Quite a long scream here, and what's the frustrated with plenty of guitar strings can see?
On Coskata.
You keep falling down, you come to another back fall, so you can see here you go, everybody is back.
Father.
And it yes is crazy, so what he's doing is he's creating a long shall we call it Chalco, so Shockley's
radicalising cryptic and coded so that you will not be able to read it.
But he can run Rennies to memory.
And here he is just pounding into a big string.
So he's using this pen operator.
If you create the first ring in the Arab League and it gives a pending new string to the original trouble,
this is the meaning of G equals N g and so it happens.
All this into one huge Chalco.
As you can see from the right hand column here, it is very long.
All right.
So this is the second stage.
The first stage bailout was the auto script, which was embedded in the recession.
We managed to unpack that by using the EIC to a the compiler manager COMPAR.
So we passed four stage now and the second stage we didn't screw this up.
This is the second pillar, which is this file here in this an encrypted or incorrect Chalco.
So in order to make sense out of this thing, we have to let this screen run and then when it's running,
we have to dumb the memory where the spot is, in fact.
So in order to know how to do that, we will need to use debuggers and also the assembler.
So in the next coming videos, how you how to do that using Ghidorah, this assembler and also xda debug
debugger.
So I'll see you in a second.
Thank you for watching.