#614: Learn Malware Analysis with Ghidra and x64dbg (for free)

Want to learn how to reverse engineer malware? Lindsay Kaye joins me to demonstrate malware analysis using Ghidra and x64dbg, two free tools you can use to develop your skills.
Lindsay is the author of Dissecting the Dark Web. In this interview, we take apart a data theft tool used by LockBit affiliates and examine BlackMatter ransomware. You’ll see how malware detects a debugger, hides strings, and loads functions at runtime.
We also run ransomware in a lab VM to show what happens to the victim’s files.
We discuss:
• How ransomware gangs steal data before encrypting it
• How static and dynamic analysis work together
• Finding malware indicators in Sysmon logs
• Why ransomware can print physical ransom notes
• How reputation and trust work in criminal forums
• How to start reverse engineering by compiling your own C programs and examining them in Ghidra
If you have some programming knowledge and want to understand how malware works, this is a practical look at the skills involved.
// Sponsored SEGMENT //
Big thank you to Proton Pass for sponsoring this video. To sign up for Proton Pass, please use the following link https://proton.me/davidbombal to get Proton Pass free.
// Link to No Starch Website for Lindsay Kaye’s Book //
Order Dissecting the Dark Web on No Starch: https://nostarch.com/dissecting-the-d...
Use Coupon Code KAYE25 for 25% off Dissecting the Dark Web at NoStarch.com
// Lindsay Kaye’s SOCIALS //
Website: https://www.lindsaymkaye.com/
LinkedIn: / lindsaymkaye
Human Security Website: https://www.humansecurity.com/people/...
// David's SOCIAL //
Discord: discord.com/invite/usKSyzb
Twitter: www.twitter.com/davidbombal
Instagram: www.instagram.com/davidbombal
LinkedIn: www.linkedin.com/in/davidbombal
Facebook: www.facebook.com/davidbombal.co
TikTok: tiktok.com/@davidbombal
YouTube: / @davidbombal
Spotify: open.spotify.com/show/3f6k6gE...
SoundCloud: / davidbombal
Apple Podcast: podcasts.apple.com/us/podcast...
// MY STUFF //
https://www.amazon.com/shop/davidbombal
// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com
// MENU //
0:00- Coming Up
0:40 - Intro (Lindsey's Book)
02:49 - Lindsey's Background
03:30 - Proton Ad
05:44 - Interesting Book Topics
07:18 - Demo Starts
10:57 - How To Follow Along With The Book
14:12 - x64 Debuggng
20:21 - Writing Rules With Stealbit
23:27 - Analysing Ransomware
28:10 - Building Your Ransomware
31:05 - Reputations On The Dark Web
32:52 - Analysing Dark Web Malware
37:30 - Running The Ransomware
41:00 – Questions to Lindsay
42:17 – How to Connect with Lindsay
42:39 – Final thoughts
Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
Disclaimer: This video is for educational purposes only.
#defcon #reverseengineering #darkweb