Description: In this video, we explore a malware evasion technique API unhooking.

Timestamps:
00:00 Intro
00:37 Inline hooking explained
02:04 Introducing fridatrace
04:12 Static analysis of Gazprom ransomware
06:18 Patching Gazprom sample
07:37 Hooking Gazprom with fridatrace
09:50 Identifying API unhooking code using x64dbg
12:14 Reviewing API unhooking code using Ghidra
19:39 Debugging API unhooking code using x64dbg

Have malware analysis questions or topics you'd like me to cover? Leave a comment and let me know!

SANS Malware Analysis Courses I Author and Teach:
https://sans.org/for610 (coauthor with Lenny Zeltser)
https://sans.org/for710

Sample: https://github.com/as0ni/youtubefile...
Password: infected
Unzipped SHA256: 32ec301f02dfa21932679726f07e30f9c807391aaf1044278c0e0b2c0dc8ebdf
Description: Gazprom Ransomware Sample

Tools
Frida: https://frida.re/
PEStudio: https://www.winitor.com/download
Process Hacker: https://processhacker.sourceforge.io/...
x64dbg: https://x64dbg.com/
Ghidra: https://ghidrasre.org/

Find Anuj Soni on X: https://x.com/asoni
Connect on LinkedIn:   / sonianuj