Hello and welcome back.
In this lecture, we are going to take a look at some common API used in malware.
So the topics you are going to look at are in networking, persistence, encryption and analysis.
Stealth execution.
Miscellaneous.
First networking.
Networking consists of a few types.
There can be raw sockets and the on the server side we have the bind API, the listen and the accept.
On the client side, we have the connect the read and receive the write and the shut down.
And on the other hand we also have the Windows API sockets, which always requires a startup to create
the initialize the socket.
On the server side, we have bind, listen, accept and on the client side we have connect, send,
receive and finally, we always have a clean up to close and dispose of the sockets that has been created
for persistence.
We have registry persistence, for example, the API registry create key registry open key registry
set value registry, delete key registry.
Get value for persistence.
We have a get temporary path copy file, create file, write file, read, file and service persistence.
We have open ask manager create service start Service Control dispatcher.
Next we have encryption.
We encrypt API using windows decrypt we acquire contacts API crypt generate key crypt destroy key crypt
drive key grip and crypt creep creep creep release context.
Then we also have the empty analysis.
For example is debugger present get system info, global memory status get version and some of the assembly
instructions cpuid and in both of which can detect virtual machines.
Then we have the 12 APIs, for example, virtual virtual protect, read process, memory, write, process,
memory, create remote track and the unmet view of session.
And these are used for injecting into other processes.
Then on the execution side, we have great process sharing.
Execute Unizik Resume thread.
There are also miscellaneous API.
For example, get async key state and set Windows hook which are used in Keyloggers and also get foreground
window which is used to identify the windows in which the Keylock is taking Keylogging activity.
We also have loadlibrary and get process address for loading external libraries.
Then they create to help.
32 snapshot is to list all the processes in running in the operating system.
We also get DC and bit build which are used for screen capture in those remote access tools and internet
open internet open URL internet read file internet write file.
All these are used in typically used in remote access tools.
So those are the common APIs which you always look for when you are doing malware analysis.
That's all for this video.
Thank you for watching.