9:37Adding imports list dumped by PE-sieve into IDA (with IFL plugin)
A 10-minute video from hasherezade: “Adding imports list dumped by PE-sieve into IDA (with IFL plugin)”.
hasherezade
12.2K subscribers on YouTube
Shorts, livestreams, trailers and promos are never listed. Unless a curator approved this channel in full, only individually picked videos appear.
9:37
4:43DEMO: Hijacking extension handlers in order to deploy a malware
A 5-minute video from hasherezade: “DEMO: Hijacking extension handlers in order to deploy a malware”.
8:20DEMO: Man-In-The-Browser (Zbot intercepting HTTPS)
A 8-minute video from hasherezade: “DEMO: Man-In-The-Browser (Zbot intercepting HTTPS)”.
3:54DEMO: what happens when we run maliciou VBS script - attack of ransomware (GlobeImposter 2.0)
A 4-minute video from hasherezade: “DEMO: what happens when we run maliciou VBS script - attack of ransomware (GlobeImposter 2.0)”.
15:43Deobfuscating TrickBot's strings with libPeConv
A 16-minute video from hasherezade: “Deobfuscating TrickBot's strings with libPeConv”.
8:58Getting familiar with HackSys Extreme Vulnerable Driver
A 9-minute video from hasherezade: “Getting familiar with HackSys Extreme Vulnerable Driver”.
9:57How Kronos malware is paired with a browser
A 10-minute video from hasherezade: “How Kronos malware is paired with a browser”.
16:53How to make a PE with no sections (using Crinkler)
A 17-minute video from hasherezade: “How to make a PE with no sections (using Crinkler)”.
6:09Kronos malware - let's take a look at the webinjects
A 6-minute video from hasherezade: “Kronos malware - let's take a look at the webinjects”.
13:24PE-sieve/HollowsHunter with custom signatures (SigFinder)
A 13-minute video from hasherezade: “PE-sieve/HollowsHunter with custom signatures (SigFinder)”.
47:38PE-sieve: an open-source scanner for hunting and unpacking malware (2019)
Advanced
A 48-minute video from hasherezade: “PE-sieve: an open-source scanner for hunting and unpacking malware (2019)”.
8:16PE_unmapper demo: unpacking TrickBot and FlokiBot
A 8-minute video from hasherezade: “PE_unmapper demo: unpacking TrickBot and FlokiBot”.
5:00PrincessLocker - how to recover files
A 5-minute video from hasherezade: “PrincessLocker - how to recover files”.
17:52Searching for AceLdr in memory, with PE-sieve/HollowsHunter [narrated]
A 18-minute video from hasherezade: “Searching for AceLdr in memory, with PE-sieve/HollowsHunter [narrated]”.
5:19Stealing an Access Token using WinDbg
A 5-minute video from hasherezade: “Stealing an Access Token using WinDbg”.
11:54Tracing executables with a Pin Tool (tiny_tracer)
A 12-minute video from hasherezade: “Tracing executables with a Pin Tool (tiny_tracer)”.
12:49Unpacking Andromeda (Gamaure) + initial analysis
A 13-minute video from hasherezade: “Unpacking Andromeda (Gamaure) + initial analysis”.
20:14Unpacking Baldr stealer
A 20-minute video from hasherezade: “Unpacking Baldr stealer”.
16:43Unpacking BitPaymer ransomware
A 17-minute video from hasherezade: “Unpacking BitPaymer ransomware”.
7:14Unpacking Cerber out of NSIS crypter + dumping the configuration (example #2)
A 7-minute video from hasherezade: “Unpacking Cerber out of NSIS crypter + dumping the configuration (example #2)”.
6:55Unpacking Cerber ransomware (example #3)
A 7-minute video from hasherezade: “Unpacking Cerber ransomware (example #3)”.
5:49Unpacking Cerber ransomware in 5 minutes + dumping the configuration (example #1)
A 6-minute video from hasherezade: “Unpacking Cerber ransomware in 5 minutes + dumping the configuration (example #1)”.
6:56Unpacking Diamond Fox
A 7-minute video from hasherezade: “Unpacking Diamond Fox”.
4:45Unpacking Dreambot (aka ISFB, Ursnif)
A 5-minute video from hasherezade: “Unpacking Dreambot (aka ISFB, Ursnif)”.
3:15Unpacking Dridex loader
A 3-minute video from hasherezade: “Unpacking Dridex loader”.
24:16Unpacking ISFB (including the custom 'PX' format)
A 24-minute video from hasherezade: “Unpacking ISFB (including the custom 'PX' format)”.
4:42Unpacking Kronos
A 5-minute video from hasherezade: “Unpacking Kronos”.
5:24Unpacking Locky in 5 minutes - using ImmunityDbg and pe_unmapper
A 5-minute video from hasherezade: “Unpacking Locky in 5 minutes - using ImmunityDbg and pe_unmapper”.
3:13Unpacking Loki Bot with HollowsHunter/PE-sieve
A 3-minute video from hasherezade: “Unpacking Loki Bot with HollowsHunter/PE-sieve”.
3:41Unpacking Magniber ransomware
A 4-minute video from hasherezade: “Unpacking Magniber ransomware”.
4:00Unpacking Magniber ransomware with PE-sieve (former: 'hook_finder')
A 4-minute video from hasherezade: “Unpacking Magniber ransomware with PE-sieve (former: 'hook_finder')”.
5:09Unpacking PrincessLocker in 5 minutes - using ImmunityDbg and pe_unmapper
A 5-minute video from hasherezade: “Unpacking PrincessLocker in 5 minutes - using ImmunityDbg and pe_unmapper”.
5:04Unpacking Ramnit with HollowsHunter/PE-sieve
A 5-minute video from hasherezade: “Unpacking Ramnit with HollowsHunter/PE-sieve”.
7:19Unpacking Smoke Loader
A 7-minute video from hasherezade: “Unpacking Smoke Loader”.
6:20Unpacking SmokeLoader (Dofoil) in 5 minutes + converting the payload (DLL) into EXE
A 6-minute video from hasherezade: “Unpacking SmokeLoader (Dofoil) in 5 minutes + converting the payload (DLL) into EXE”.
6:27Unpacking Terdot.A/Zloader.
A 6-minute video from hasherezade: “Unpacking Terdot.A/Zloader.”.