12:25

08 - Reverse the Shell and Series Wrap-up

07:47

07 - Populating SOCKADDR_IN and Calling Connect to Connect to The Attacker System

07:34

06 - Starting to Call Windows API Functions, Getting a Socket Handle

09:14

05 - Figuring out Stack Layout for Local Variables and Structures

09:02

04 - Loading WS2_32 with LoadLibrary and Wrapping Up Runtime Linking

13:18

03 - Runtime Linking for Kernel32 and Preparing to Load WS2_32 for Socket Communication

06:12

01 - Building a Reverse Shell Game Plan with a Simple C Program

18:11

02 - Exploring the Reverse Shell Source Code and API Breakdown

05:27

10 - Cleaning Up our IDA Database using Offsets

08:38

09 - Using AddressOfNames, AddressOfOrdinals & AddressOfFunctions arrays to find function pointers!

12:12

08 - Understanding the Export Directory Structure

13:48

07 - Parsing PE Headers to Locate the Export Directory

06:19

03 - C++ Name Mangling - Identifying Operator New in IDA Pro

17:11

01 - C++ Name Mangling - Investigating Overloaded Functions

08:20

02 - C++ Name Mangling - Creating Multiple Object Files

14:41

What Are Relocations? Exploring the Relocation Table

03:30

06 - Adjusting Structure Bases for Better Reverse Engineering

15:49

05 - Computing Pre-Computed Hashes Instead of Using Strings

13:05

04 - Using the LDR_DATA_TABLE_ENTRY Structure to Find Module Names

13:21

03 - Capturing a Time-Travel Debug Trace and Identifying Usage of the PEB

08:11

02 - Identifying Signs of Runtime-Linking using CAPA and IDA Pro

07:50

01 - Basic Analysis of the Sample

09:29

04 - Uncovering the Final Stage Payload and Identifying the Malware Family (it's AgentTesla)

13:36

03 - Identifying Use of Auto-IT Scripts, More Shellcode and Some Encryption

00:49

00 - Following the Trail from an RTF Doc to AgentTesla - Analysis Objectives and the Sample

11:24

01 - Initial File Triage and Shellcode Identification

06:46

02 - Identifying Shellcode Entry Point and Analyzing Common Shellcode Techniques

13:43

13 - Creating an XOR Unpacking Stub

01:09

00 - Introduction to Working with Time Travel Debugging in Binary Ninja

05:17

03 - Replaying TTD Traces in Binary Ninja

08:28

02 - Recording a TTD Trace with Binary Ninja

10:59

01 - Installing WinDbg and Configuring Binary Ninja

09:50

Analyzing Shellcode - Finding the Entry Point Based Off Position Independence

06:53

Stepping Through Signatures in Detect-It-Easy: Leveraging the Signature Debugger

05:47

09 - Preventing Debugging by using SystemFunction40 (RtlEncryptMemory) on DbgUIRemoteBreakIn

07:08

12 - Creating Simple String Obfuscation with XOR

06:16

11 - Using MOV Instructions to Create Stack Strings

12:37

10 - Understanding Endianness and Creating Stack Strings

05:56

09 - Exiting Our Shellcode Cleanly with ExitProcess

10:46

08 - Calling MessageBoxA from our Shellcode!

07:15

07 - Using LoadLibraryA to Load USER32.dll

14:51

06 - Generating Module and API Hashes to Perform Runtime Linking

10:01

05 - Creating Position Independent Code using CALL $+5

04:47

04 - Wrapping Shellcode into PE Files and Debugging with IDA Pro

04:08

03 - Using SCLauncher and x32dbg to Debug Shellcode

11:09

02 - Using SCLauncher and WinDBG to Debug Shellcode

12:10

01 - The Build Environment, Required Tools, and Series Resources

02:09

00 - Welcome to Creating Shellcode and Prerequisistes

10:29

05 - The Basics of Creating Custom Rules

08:31

04 - Using Fakenet-NG for Network Emulation and PCAP Generation

08:59

03 - Processing PCAPs in Offline Mode

04:47

02 - Manually Updating the Ruleset with Emerging Threats Open

04:10

01 - Installing Suricata into the FLARE-VM

09:21

08 - Using ZwSetInformationThread to Detach Debuggers

29:46

07 - Creating Trampolines and Re-Obfuscating Function Pointers

10:42

Enabling Rule Profiling in Suricata - Compiling from Source

15:34

06 - Finding Functions from the Export Directory and Using Seeds to Compute Checksums

14:12

05 - How Lockbit Uses the DLL Name as a Seed for API Hashing

16:29

04 - Walking the PEB, Enhancing IDA's Output w/ Structures, and Unlocking the Key to Runtime-Linking

16:25

03 - Identifying Signs of Runtime-Linking and Building Context for API Hashes