Hello and welcome to a new section.
In this new section, we are going to reverse engineer a new malware sample, which is also
known as the TeslaCrypt Ransomware.
The learning objectives for this section are:
Analysis of the TeslaCrypt Ransomware File Identification.
For this, you will need to use the usual tools for identifying the file type, like TrID.NET,
for example.
And then we'll be doing something different.
You'll be trying to find out what the packer is, but you won't be able to find any signature.
This is because TeslaCrypt was packed with a custom packer.
But anyway, you need to go through the process of trying to identify it using Detect It Easy, also
known as DIE, and also Exeinfo PE.
But both of those tools will yield no results.
It will not show any packing, but that does not mean it is not packed.
So to find out, dig further into whether or not it is packed.
You need to use PEStudio, and PEStudio will show you that the number of imported functions are very few.
And another thing is, in the sections, you will find that the entropy is very high,
above seven.
Entropy maximum is eight.
Normal unpacked
code
entropy is only 5 to 6, but anything above seven usually means it is packed.
So you need to use PEStudio and analyze the sections to look at the entropy.
Then
you will use x64dbg debugger
to let the program unpack itself into memory.
But you need to put the breakpoint on the correct API.
And the technique to do that is to use a breakpoint on the API known as VirtualAlloc.
And then you need to let it unpack itself, but before it runs the unpacked memory,
you are going to use another tool to dump the memory for the unpacked
addresses, and that will be Process Hacker.
And then lastly, you will start the Ghidra program to disassemble the dumped memory,
and then you can analyze it if you want.
So these are the learning objectives for this section.
If you feel up to it, I encourage you to give it a try on your own before you take a look at the next
videos on how I do it.
So go ahead and give it a try.
Good luck and see you in the next one.
Thank you for watching.