Hello and welcome back.
In this video, we are going to continue with trying to decrypt the resource here to see what is inside
it by setting some breakpoints and let it run and allow it to decrypt itself.
And then we will dump the decrypted memory into a separate file for analysis.
So this is the trick we did before and we are going to do it here as well.
So the few breakpoints we are going to set is firstly this one here, one breakpoint here, second breakpoint
would be here.
Okay, So we click on Decrypt and here we put a breakpoint here because RSM decrypt will decrypt whatever
is in the resource and then copy out to array.
So we want to capture this array to in memory and dump it.
Okay, so let's get started.
So let's run it now.
Click.
Okay.
Click.
Okay.
Click.
Yes.
All right.
It has hit our first breakpoint.
Let it continue.
So we are going to see this text here.
What is there?
Run!
Step over and see the text.
Here is program data mail dot txt.
And this is the file we saw early on when we did dynamic analysis.
All right, let's continue the step over.
So let's step over.
Okay.
Return result.
Okay, let's run.
All right, so now it's hit our decrypt.
And over here.
It is very step over.
All right.
Now it's going to return a array to.
So let's go down here and see what is the ray to.
All right, so array two is here.
We can right click and view it.
Show it in memory window.
Memory one.
And here you can see that it has got the magic byte M Z, which is the start of the header and also
the string.
This program cannot be run in Dos mode.
So these two is confirmation that is an exe file.
So it has decrypted the resource section and now we can see the content of it.
And so what we do now is we can dump this memory into a separate file, right click here, Save Selection.
And here we can store it as dump dot bin.
Click save.
So now that we have saved and dumped bin, we can stop this one and we can go and analyze this one using
P studio.
So let's open our P studio.
P studio under utilities.
Here you go.
Just double click on it.
Now we're going to open.
The dump in studio.
And let it analyze.
And now you can see here that this executable, which we already decrypted from the resource section,
is got a description called Web browser password view.
So if you click on this here, you can see that the name of this product is web browser password view,
and the company name is Nullsoft.
So it seems that our malware authors did not write their own web browser decrypter password stealer.
Instead, they use a commercially available password recovery from near soft and then just embedded
the exe file after encrypting it, embedded it inside the resource section.
So this is how we can defeat the encryption for the embedded file using the spice ability to debug and
set breakpoints and dumping memory as well.
So the next thing I want okay, we can stop this now.
The next thing I want to show you is how you can the obfuscate this module, this one which we saw just
now.
So in order to obfuscate this class here, we can use something called D for Dot.
So let's close this now.
So let's go to our file path.
We want to of escape this file so we select the.
Copy the path.
Open a command.
Command prompt.
Because the folder is a command line tool.
And then here, navigate to this path that contains our Trojan.
Do a dir to confirm it's there.
And then type D for dot, followed by the name of our Trojan.
Hit enter and let it do its due obfuscation.
It has detected an unknown obfuscator.
And clean it into a separate file here called dot malware clean.
All right, so now we can open this dot malware clean inside our spy.
So we just drag the clean file.
Put it in here.
And now we open and take a look.
We have a new file, the obfuscated G class zero, which was previously in this file.
Oh, so this is how we can obfuscate any part of the class which has been obfuscated since.
It's the obfuscated.
You can go ahead and analyze it using spy, using the techniques that I've taught you in this course.
So that's all for this lab walkthrough.
Thank you for watching.