The Innerworkings of Ransomware
summary
Explains how Locky and WannaCry actually operate: binaries copy themselves to temp, delete shadow copies, set startup registry entries and fetch keys from a command-and-control server using a domain generation algorithm. Demonstrates an Arctic Wolf labs unpacked WannaCry video, inspects samples with PE Studio and VirusTotal where 62 of 67 engines flag malware, and shows live encryption to .wnry files. Notes use of RSA-2048 and AES-128, the worm behavior via EternalBlue, and that paying ransom is a business with customer support.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:06Social engineering infiltration
- 3:14What happens after ransomware is downloaded on a machine
- 5:44Locky execution breakdown
- 8:14Key retrieval via domain generation
- 11:32WannaCry unpacking demo
- 16:35WannaCry network analysis
- 18:44Summary
related talks
37mWannaCry: inside a devastating ransomware
52mRansomware 101: Get Smart Understanding Real Attacks
14mThe Conjuring: ransomware edition!!
45mThe Invisible War A Look at the Ransomware Battle
32mSurviving a Ransomware Attack - Lessons from the Field
51mThe New Scourge of Ransomware: A Study of CryptoLocker and Its Friends
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
32mProspecting Ransomware Tech