Counterfeiting the Pipes with FakeNet 2.0 (Part 2/2)
summary
FakeNet 2.0 is a Windows network simulator that mimics HTTP SSL and DNS, logs traffic to PCAP and supports Python extensions; the lab uses it to intercept a real sample that injects into notepad.exe and queries bb.practicalanalysis.com hello.analysisbook.com and rarer domains like orvalandrr.com and passwordis.com. Enabling process logging reveals the injected process, turning on connection break drops into the debugger so a served file beginning with byte 0x42 triggers a message box, proving the approach works.
AI-written summary · about
chapters (8)
- 0:00Lab setup and introduction
- 1:26Initial malware analysis
- 2:27Debugging and breakpoints
- 3:24Explaining lab goals
- 5:58Understanding NX domains
- 7:14Practical demonstration
- 9:31Code analysis and debugging
- 12:22Final malware resolution
related talks
32mFaking a Factory: Creating and Operating a Realistic Honeypot
44mNetsec is Dead(?): Modern Network Fingerprinting for...
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
53mForensic Investigations of Web Exploitations
19mDeceptive Security using Python
30mNetwork Technocracy: A Tale of Monitoring, Spoofing, Intercepting and Social Engineering
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
01h 01mSomething Something Cyber