Extract Shellcode from Fileless Malware like a Pro
Here I demonstrate how to extract shellcode from the context of a malicious Word doc which uses VBA to inject shellcode into the memory space of a victim process.
This code injection is executed solely in memory, therefore is considered 'fileless' as it never touches the disk. Good news for bad guys here is that conventional detection mechanisms will struggle with this kind of activity. Bad news for bad guys is that the malware only persists in memory, therefore dies with a reboot.
This is a super interesting technique of executing malware. I demonstrate to you how to extract the shellcode and convert it into a 'usable' executable for the purposes of further analysis and take a step further with you down the rabbit-hole and show how to debug such shellcode using x64dbg. Additionally I show how you can actually identify the shellcode origin with it's true intention using some basic OSINT and how to step through and extract relevant network indicators for the purpose of protecting your environment against such malicious traffic.
MD5 of the sample discussed: da6cc46575a6bc74509155b5f2657577
Enjoy the video - you can follow me on / cybercdh and also don't forget to subscribe to my channel :)
On this page of the site you can watch the video online Extract Shellcode from Fileless Malware like a Pro with a duration of hours minute second in good quality, which was uploaded by the user cybercdh 25 July 2017, share the link with friends and acquaintances, this video has already been watched 22,724 times on youtube and it was liked by 682 viewers. Enjoy your viewing!
