Hello and welcome to a new section in this new section, we are going to reverse engineer new malware
malware sample four, which is also known as the test Tesla run ransomware.
You're learning objectives for the S.R. analysis of the test market ransomware
ID.
For this, we need to use the usual tools for identifying the type like TriNet, for example.
And then we'll be doing something different.
You'll be trying to find out what the Bekker is, but you won't be able to find a signature.
This is because this socket was packed with a custom PECC.
But anyway, you need to go through the process of trying to identify using the detector is also an
idea and also to be informed by both of those tools school, you know, that he will not show any begging,
but that does not mean it is not backed.
So to find out, dig further into whether or not it is packed, you need to use bees to you and bees
to you.
Sure, you get a number of important functions, very few.
And another thing is in the sections, you will find that the entropy entropy is very high.
About seven entropy maximum is eight.
Normal UNbacked court entropies, only five to six, but anything above and seven you should immediately
respect.
So you need to use your piece to do it in the right decisions to look at the entropy.
Then.
You will actually be given debugger.
To let the program unpack itself into memory.
But you need to put the big point on the carpet, and that I need to do that is to use Bitcoin on the
API known as Virtual ALAC.
And then you need to.
Let it unpack itself.
But before he runs the memory.
You are going to use another tool to dump the memory for the.
And dresses, and that will be processed Hekker.
And then lastly, you will start the Jutras program to disassemble the dumped memory and then you can
analyze it if you want.
So this is the only objectives for the U.S..
If you feel up to it, I encourage you to give it a try on your own before you take a look at the next
videos on how I do.
So go ahead and give it a try.
Good luck and see you in the next one.
Thank you for watching.