Triaging Malware with Malcat (Stream - 29/07/2025) скачать в хорошем качестве

Triaging Malware with Malcat (Stream - 29/07/2025)

In this stream we have Renaud Tabary of Malcat walk us through triaging an Emotet infection chain with Malcat. Throughout this stream we triage a malicious Microsoft Word document that contains VBA code, and write a static unpacker for a packed Emotet binary. We also highlight using Malcat to write Yara rules, how to apply its internal anomaly detection techniques, and use the Kesakode database for malware identification. Malcat: https://malcat.fr Malware files to follow along with: https://www.malware-traffic-analysis.... Merch: https://shop.invokere.com/ Learn how to reverse engineer malware: https://training.invokere.com/ Twitch:   / invokereversing   Twitter:   / invokereversing   BlueSky: https://bsky.app/profile/invokerevers... Mastodon: https://infosec.exchange/@invokerever... Introduction: 0:00 Malcat Overview: 1:03 Analyzing Maldocs in Malcat: 4:35 Summary View: 5:04 Anomalies: 7:24 Chat Question for CFG Research: 8:37 Carved Files and VFS: 10:18 Structured Text: 13:32 Source Code / Decompiler View: 14:39 Malcat Transforms: 16:11 Analyzing Emotet Binary: 25:57 Executable Anomalies: 28:25 DNA Sequences: 29:10 Executable Anomalies Continued: 31:18 Hex View Highlighting: 33:58 Unpacking Code: 35:03 Adding Custom RC4 Transform: 45:09 Kesakode Matches on Unpacked PE: 49:08 Writing a Yara Rule: 52:58 Wrapping Up: 59:38