#614: Learn Malware Analysis with Ghidra and x64dbg (for free)

Want to learn how to reverse engineer malware? Lindsay Kaye joins me to demonstrate malware analysis using Ghidra and x64dbg, two free tools you can use to develop your skills.

Lindsay is the author of Dissecting the Dark Web. In this interview, we take apart a data theft tool used by LockBit affiliates and examine BlackMatter ransomware. You’ll see how malware detects a debugger, hides strings, and loads functions at runtime.

We also run ransomware in a lab VM to show what happens to the victim’s files.

We discuss: • How ransomware gangs steal data before encrypting it • How static and dynamic analysis work together • Finding malware indicators in Sysmon logs • Why ransomware can print physical ransom notes • How reputation and trust work in criminal forums • How to start reverse engineering by compiling your own C programs and examining them in Ghidra

If you have some programming knowledge and want to understand how malware works, this is a practical look at the skills involved.

// Sponsored SEGMENT // Big thank you to Proton Pass for sponsoring this video. To sign up for Proton Pass, please use the following link https://proton.me/davidbombal to get Proton Pass free.

// Link to No Starch Website for Lindsay Kaye’s Book // Order Dissecting the Dark Web on No Starch: https://nostarch.com/dissecting-the-d... Use Coupon Code KAYE25 for 25% off Dissecting the Dark Web at NoStarch.com

// Lindsay Kaye’s SOCIALS // Website: https://www.lindsaymkaye.com/ LinkedIn: / lindsaymkaye Human Security Website: https://www.humansecurity.com/people/...

// David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast...

// MY STUFF // https://www.amazon.com/shop/davidbombal

// SPONSORS // Interested in sponsoring my videos? Reach out to my team here: [email protected]

// MENU // 0:00- Coming Up 0:40 - Intro (Lindsey's Book) 02:49 - Lindsey's Background 03:30 - Proton Ad 05:44 - Interesting Book Topics 07:18 - Demo Starts 10:57 - How To Follow Along With The Book 14:12 - x64 Debuggng 20:21 - Writing Rules With Stealbit 23:27 - Analysing Ransomware 28:10 - Building Your Ransomware 31:05 - Reputations On The Dark Web 32:52 - Analysing Dark Web Malware 37:30 - Running The Ransomware 41:00 – Questions to Lindsay 42:17 – How to Connect with Lindsay 42:39 – Final thoughts

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!

Disclaimer: This video is for educational purposes only. #defcon #reverseengineering #darkweb