Hey everyone, I messed up the editing for this release and two clips are out of order. The correct order for Parts I and II of Dynamic Analysis of an Unknown Binary should be as follows: 3:00:54 - Part 1 Basic Dynamic Analysis 2:39:37 - Part 2 Basic Dynamic Analysis I apologize for the confusion!
@zizzixsec
Жыл бұрын
A side note for anyone who runs wannacry at the first detonation and nothing happens, Make sure you disable inetsim on the remnux box as the first thing wannacry does is reach out for a dns host and if it replies, it wont run. Thats how Marcus disabled it in the first place.
@PlentyRude
Жыл бұрын
Thanks!
@0xKilty
Жыл бұрын
Thank you for this
@ily_alex1
11 ай бұрын
thank you so much, I've actually been stuck on this for some time, and it was like the first time in my life I was frustrated over a piece of malware that doesn't wanna run on my system
@repairstudio4940
5 ай бұрын
Very helpful, thank you ❤
@KenPryor
Жыл бұрын
I recently completed the full 9 hour course on TCM and loved it. Great class!
@huskyhacks
Жыл бұрын
Hey fam! I just released a new, free section of PMAT that includes more detail about the security of Host Only networks and how to set up an Internal Network for malware analysis. It fits right in after the video at 51:39:00. Check it out here: notes.huskyhacks.dev/blog/malware-analysis-labs-internal-network-vs-host-only
@d4ddyn0n4me8
2 жыл бұрын
Im about 60% through your course loving it gotta stalk your youtube for everything i need more.. MOOORE 👁️👄👁️ Would definetly recommend his course for anyone reading :D
@wiredogsec
2 жыл бұрын
Thank you! I managed to pick up the full course (as well as others) during the $1-$6 discount event! You guys are awesome! I am halfway through PMAT and I am enjoying it. This is definitely worth the money! TCM Security has high quality and very affordable training.
@khodorj6581
Жыл бұрын
Hello, i want to ask how can I drag and drop the malware folder from host to FlareVM, not able to perform this action
@wiredogsec
Жыл бұрын
@@khodorj6581 I am using VMware Workstation and I had to install VMware tools. There is probably a similar process for VMware Player or VirtualBox.
@talalsallmart1
Жыл бұрын
@@khodorj6581 in vm settings set them drag modes to bi directional
@somberrage4692
Жыл бұрын
Excellent resource. Certainly appreciate the effort that went into this! I encountered an issue with the Windows machine where it wouldn't be fed any fake html page after manually setting the DNS on the Windows machine for the Remnux host. The issue was with the LAN Settings Automatically Detect Settings configuration. Unchecking this box within Internet Explorer resolved the matter. Just in case anyone oberves this as well.
@tannerjones1331
Жыл бұрын
Great course! I just made it through the tutorial! I was able to solidify my understanding on basic malware analysis. I have taken a course in my graduate studies and it was a great supplement.
@francesco2092
9 ай бұрын
this is why they say that teaching is an art... you can make someone who knows nothing understand things and slowly take them to the next level is spectacular... as soon as I finish these 5 hours I can't wait to go to buy the rest of the course.
@carenmorenmoren9156
Жыл бұрын
I don't usually comment on KZitem but you deserve admirations. I will make sure to mention you in every interview I have for Threat Intel position and to everyone who is interested in Threat Intel/Malware analysis career path. Thank you is not enough.
@niless577
14 күн бұрын
It was an amazing and helpful tutorial for beginner malware analiyst. Thank you so much, I was searching something like this and your content is exactly what I was looking on the internet. Thank you again🤗
@logicbypass
Жыл бұрын
Some may have noticed that the part of Basic Dynamic Analysis was not mounted in the proper order. 3:00:54 - Part 1 Basic Dynamic Analysis 2:39:37 - Part 2 Basic Dynamic Analysis Thank you @huskyhacks531 for a fantastic tutorial
@huskyhacks
Жыл бұрын
Yep, I just realized this. Thank you for pointing it out. I just looked into the editor to see if I could rearrange the order but it doesn't look like that's the case. I'll add something to the description and a pinned comment to try to clear up any confusion.
@ReMaX2013
Жыл бұрын
i just completed the course , i really want to thank you for sharing that for free
@repairstudio4940
5 ай бұрын
This has been such an amazing journey. Much respect to Husky! Heath's crew @ TCM are awesome! 🎉
@daredevil_orchid
Жыл бұрын
Man you are so generous. Now I can tell my Junior to learn from here to know if he's into malware analysis. Btw I already have the full course and I'm halfway done.
@scottcarey2483
Жыл бұрын
Glad I found this video. I'm getting in to malware analysis in my job and I think your course will be a great intro. Do you cover analysis of malicious websites too?
@user-up7yn5eg5f
6 ай бұрын
In remnux when i mount it said no medium found on dev/sro what i can do for these
@slicknick77
4 сағат бұрын
Go to devices>insert guest additions cd image... >run
@rasperss_5176
Ай бұрын
One tip, personally I would go the extra step and by ensuring clipboard sharing is disabled when deploying malware. I don't think he mentioned that and did notice he had it enabled when copying hashes to virus[.]total just my two cents. But great video none the less!
@atikullah9066
5 ай бұрын
best malware analysis course. Thanks for this amazing course
@mohsinhafeez
2 жыл бұрын
I already have your course, but its good to see it on youtube :)
@rosjja
11 ай бұрын
You earned a sub, my friend 😊
@firosiam7786
2 жыл бұрын
Good to see you share this much for free to many people God bless you.
@philosphize
7 ай бұрын
Thank you so much for this amazing tutorial Please release next set of malware analysis video
@NickGalaftion
Жыл бұрын
Excellent intro to malware analysis ! great job ! looking fwd at many more videos ..
@libusengmengwai3215
2 жыл бұрын
Thank you Matt, we truly appreciate the 🎁
@julieuzii6350
10 ай бұрын
awesome video, thank you for all the information. I am a cybersecurity student and found this video invaluable.
@brandonevans5123
2 жыл бұрын
I can't wait to watch this all the way through! Thank you!
@Hanacan75
6 ай бұрын
Thank you my friend. Excelent tutorial :) I'm cheering for you to do more. hhaha
@youaregod2382
2 жыл бұрын
Thank You for this. i actually finished your course,it was really awesome experience lots of good learning, Highly recommended your course. A very good teacher😍😇
@rodrigopatino3382
Жыл бұрын
How to filter on Procmon: 2:27:00 3:28:42
@Lwyte17
Жыл бұрын
Im curious, has the FLAREVM installation changed? I went through the process but simply get a folder named Tools instead of FLARE. Also it seems the packages that get installed are different than those seen the video, for example no peview. Is that just necause theyve changed their tool lost in the config file?
@_Slaze
Жыл бұрын
Thank you for the awesome course
@wendy_113
10 ай бұрын
I cannot thank you enough.
@user-ec8mo1jn4m
Жыл бұрын
I can't thank you enough, Matt 🌸💝
@nicksunny100
6 ай бұрын
Subscribed!!
@Don01841
Жыл бұрын
Appreciate the effort you put in this video. Amazing content. What i liked about the video is the way it has been explain which clear and to the point. Thanks husky.
@yaseerkadam9496
Жыл бұрын
You're the best bruh
@dendell8860
Жыл бұрын
Great Video..Thank you
@nelsonnelson31
Жыл бұрын
Good Lecture man!
@piyushgayaki9667
5 ай бұрын
Thanks a lot sir. Just what to know for after ransomware detonation which tools I can use for dynamic analysis like you have shown how to use procmon and procexp but when I detonate the ransomware tools get crash.
@hyphen686
3 ай бұрын
Can you show the same lab setup using VMware Workstation Pro? I haven't been able to find a single video on this topic.
@Manavetri
Жыл бұрын
Brilliant !!!
@user-ry8gt1qw8y
Жыл бұрын
Thank you so much for all your hard working ,but I do not know why the commands did not work for with me at the beginning?
@RozzClips
9 ай бұрын
Thank you so much
@_clavita
2 жыл бұрын
I bought this and im so happy i did
@todorokiyosukedesu
2 жыл бұрын
Did you bought it on TCM Security?
@_clavita
2 жыл бұрын
@@todorokiyosukedesu yeah!
@user-xn5cu3bg8r
6 ай бұрын
Hello Sir, I am facing one issue, whenever I try to arm any binary, win10 defender or firewall removes it, Although all security options are turned off, Via Real Time Protection, Registry entry, group security policy etc. Still whenever any binary is converted to armed mode, windows automatically removes it. Kindly help what to do?
@Old_SDC
11 ай бұрын
Waiting for Remnux to install 20:58 I’ll be back whenever I remember to continue 24:40
@Lead3RVideos
2 жыл бұрын
Gonna need to make some time for this.
@sagartimalsina4120
4 ай бұрын
Just a quick question.. why does my Network setting is not working? I tried everything but the configuration is just not working in my case? Any solution?
@NewbieValorantYT
22 күн бұрын
is it ok to enable the clipboard share feature on flarevm ?
@BorisJohnsonMayor
Жыл бұрын
Was hoping someone could answer a question regarding downloading file samples directly from an EDR dashboard. For example, 365 Defender from MS allows me to download a password protected zip file with the sample in question. However, as I am signed in with the company admin account used to access the EDR dashboard and subsequently have to download the sample to my work machine, how can this be done safely? Do I create a read only account for the dashboard access and sign in to that account in a lab environment and then download the sample? Do I just download the zipped sample on my work machine and send it elsewhere? I'm trying to limit as much possible risk from downloading a sample during an investigation and unfortunately Microsoft don't make this easier in the 365 defender dashboard.
@coolheis7469
Жыл бұрын
Congrats for ur great work and thanks for the content! I wanted to ask u if the host only adapter is safe because somewhere i read that this is not the case since the vm can communicate with the host.
@huskyhacks
Жыл бұрын
I actually just wrote a new section of PMAT about this specifically! notes.huskyhacks.dev/blog/malware-analysis-labs-internal-network-vs-host-only
@quasaaaar
Жыл бұрын
Edit: I found the answer to the below from your later explanation. However I did waste plenty of time trying to figure out myself. Here what took me further in the wrong direction is when I tried to open the malz file with 7zip and it did actually open it and presented a heirarchy of files and even 2 executables inside. So perhaps you need to rearrange the video so the safety part comes before any detonation. This is so others don't waste time like me (or worse, do something harmful) Thanks. Original post: Hi. At 57:08 you jumped to the next video and started working with the wanacry exe. However the file from the repository extracted in the previous video is ransomeware.wanacy.exe.malz So how did we jump from that to that?!?
@huskyhacks
Жыл бұрын
That question and more are addressed in the course FAQ, which is located on the course Discord (link in description). If you get stuck like that please check the Discord, it's likely another student has asked the question before and we can get you back on track
@quasaaaar
Жыл бұрын
@@huskyhacks I found another problem in the youtube video. The 2 video parts of basic dynamics with RAT.Unknown are in reverse order. The first video comes 2nd and the 2nd video comes 1st.
@huskyhacks
Жыл бұрын
@@quasaaaar Do you mind replying with the time stamps of what you think is out of order? I just skimmed that section and it all looks to be in order
@quasaaaar
Жыл бұрын
@@huskyhacks for Rat.unknown: Part 2 @ 2:39:35 Part 1 @ 3:00:55
@huskyhacks
Жыл бұрын
@@quasaaaar The samples in the sections you've timestamped are different samples. The course material includes multiple samples in the Basic Dynamic Analysis section. The times you've mentioned correspond to Part 2 from the first sample and Part 1 from the second sample
@nostolgiagore
10 ай бұрын
cutter and PEview are missing on flarevm
@buzgie
8 ай бұрын
listening to all the safety spiels as a linux user is funny. I have a habit of just leaving malware .exes lying around my pc because it can't do anything aha
@francesco2092
8 ай бұрын
at the 4.00.31 i don't understand how i find the metasploit module for use the reverse shell?
@gadadharnayak5648
Жыл бұрын
is malware analysis job generally full time job or are there part time jobs as well?
@stressless8405
Жыл бұрын
This is phucking fantastic. Very well explained
@hemaraj8223
Жыл бұрын
While mounting th CD-ROM directory It says no media found under /dev/sr0
@angelaguirre9384
11 ай бұрын
Just click on Devices -> Insert Guest Additions CD image... The no media found error should be solved after this
@ThatBlueFalcon
4 ай бұрын
@@angelaguirre9384 Thanks for saving me!
@nishadbabu8130
Жыл бұрын
this course related to TCM security pratical malware analysis
@user-up7yn5eg5f
6 ай бұрын
floss cmmand not working in my cmd said that it is not recognizeble how to solve this issue
@AaryadevVRBLX
Жыл бұрын
Hello , I am not able to drag the malware folder from the host to FlareVM, anyone please help
@mahetsiedahi6530
7 ай бұрын
were you able to solve the problem?
@AaryadevVRBLX
7 ай бұрын
@@mahetsiedahi6530 ITS BEEN A YEAR
@kzkaa.
2 ай бұрын
@@mahetsiedahi6530 Turn on host to guest in the drag-and-drop setting
@reiserkeiser
Жыл бұрын
That first malware file from close to an hour in just will not execute.
@043-namanvora2
5 ай бұрын
hey husky i tried to download the repo on my physical host but the defender and browser didn't let me download the repo as it was detection viruses into it can you help me with it please
@OldDirtyDragon
5 ай бұрын
Same issue. Best I can find, the latest version of Win10 does not allow users to disable MsMpEng.exe. It is owned by the system. That's Microsoft's main AV scanner. Have not found a way around it yet.
@043-namanvora2
5 ай бұрын
@@OldDirtyDragon well bro it is a very simple issue what i did that i cloned the repo using git clone command and further it was downloaded on the pc but i made sure i dont open or unzip the repo, i further enabled the drag n drop from host to machine option temporarily for flarevm after dropping the repo into the flarevm i disabled the drag n drop option from v box and made sure that i have deleted the cloned repo from my physical machine and during all this process i didn't touched or twitch the windows defender should work for you as well
@ninjaspeedone
7 ай бұрын
When I try to mount the cdrom I get this error message, mount: /media/cdrom: no medium found on /dev/sr0.
@amirahabubakar3277
3 ай бұрын
Go to devices>insert guest additions cd image... >run
@JustinWalker951
Жыл бұрын
21:56 I get error "no medium found on /dev/sr0" :(
@ricorobinson3954
Жыл бұрын
It means the needed files are already on your distro. Your good to go!
@user-jv6pq8uj2t
5 ай бұрын
Thank you very much for this video, can I get your mail id so that can discuss which are related to this in details. Am a PhD student and faculty in an organization, my work on this is very interesting.
@haneesha3548
3 ай бұрын
i cannot find the flare-vm github repo
@mayavik1034
Жыл бұрын
man disabling the Defender is a real PIA, I tried everything. Being Denied access, even with Administrator access. Does anyone here have any ideas.😰
@angelaguirre9384
11 ай бұрын
I'm trying to get through the course but I'm not able to run the powershell script from flare-vm. I'm stuck trying to disable Windows Defender... Damn, I've even followed all the links provided under the github repository to do this but none seem to work. Hence I'm stuck here trying to run the powershell script ...
@angelaguirre9384
11 ай бұрын
Just for anyone that might face the same issue. I just went ahead and installed Windows 11 on my VM. I was finally able to disable windows defender with the help of John Hammond's yt video. Flare VM install script has successfully ran and I will be continuing the course later today.
@arturcorreia6615
3 ай бұрын
Windows Defender is not letting me detonate de virus :(
@user-ut5vf7qy5o
3 ай бұрын
I am still a beginner, how to install the files to my flare vm and I have no connection to the internet ?
@muhammedbadawy1543
2 ай бұрын
You download it into your main machine then enable drag and drop (host to guest) and transfer the files into the Flare VM
@Muhammad80008
10 ай бұрын
Cool :)
@sambhavjain6929
5 ай бұрын
5:02 5:03 5:05
@hasanbacha7796
2 жыл бұрын
Hello, I am trying to find a way to contact Matt Kiely to ask him about his training video i just purchased and i am not able to mount the file.
@huskyhacks
2 жыл бұрын
Hello, please check the description of this video for some notes about that issue.
@jj691
Жыл бұрын
@105:10 did you adjust your DNS and just edit that portion out?
@jj691
Жыл бұрын
Never mind you cleared the air on this about 10 minutes later! :)
@junaidsheraz8520
Жыл бұрын
I'm trying to download labs from the URL given in description but it says "Virus detected" and then stopped downloading. Please solve my query
@TheRealTopTV
11 ай бұрын
download it on the vm and not your host, after its down disable nat again
@emilisha-in4xl
9 ай бұрын
Is this course basic or advanced?
@114thp7
Ай бұрын
Hi, mr Husky. I have a little bit problem. As you showed at 59:09 to run wannacry then try it in my flare VM but wannacry.exe didn't run. I wonder why this happened(defender was off) Thanks in advance
@mattanderson2074
Ай бұрын
You probably have the same issue as me - using a Windows 10 build which is no longer vulnerable to wannacry.
@114thp7
Ай бұрын
@@mattanderson2074 i dont know why, but it worked. Wannacry works properly
@user-xn5cu3bg8r
6 ай бұрын
hello
@josephblack7408
11 ай бұрын
My laptop doesn't support virtualization what to do in this condition?
@Robalo450
9 ай бұрын
lolololol
@opmfa1850
Жыл бұрын
i installed inetsim and configured it like you did but i dont get a page when i try to access any web site
@ytriskad3889
Жыл бұрын
did you fix it?
@opmfa1850
Жыл бұрын
@@ytriskad3889 yes but dont remember how
@Crixus0112
Жыл бұрын
@@ytriskad3889 Hey, I had the same issue you had and was able to get it to work. Let me know if you still have this issue and I can tell you how I got mine to work and that might help in oyur case.
@ytriskad3889
Жыл бұрын
@@Crixus0112 yeah that would be nice
@khodorj6581
Жыл бұрын
Hello , I am not able to drag the malware folder from the host to FlareVM, any idea?
@AaryadevVRBLX
Жыл бұрын
Hi ,I am facing same issue,Can you please share if you already resolved the problem.
@imvishal8352
Жыл бұрын
@@AaryadevVRBLX @khodorj6581 Same here, have you found the way ? do share the idea.
@tomaszskrzypczak3294
9 ай бұрын
Hello, you need to enable drag and drop in your VM. On running VM, on toolbar, go to devices -> Drag and Drop -> Host to Guest
@hydradragonantivirus
5 ай бұрын
Malware analysis didn't work anymore.
@AntonMaverick94
2 ай бұрын
May I know why?
@user-td5pl8ui5z
Жыл бұрын
Isn't this a paid course?
@cyrusmutua9276
Жыл бұрын
Full course covers up to 9 hours, the first 5 hours are completely free.
@Robalo450
9 ай бұрын
Can anyone get past the "The Installer GUI" where you can select the different packages you want installed? I dont have the option to confirm yes or no and proceed.
@modbat9463
10 ай бұрын
why i cant open the Malware.Unknown.exe ? if i renamed it from .exe.malz to .exe it wont run at all. it says i have to look in the microsoft store to search an app to run it. And could anyone tell me how to get the malware on the vm without compromising my main operating system? Thanks and Great video!
@Robalo450
Ай бұрын
How do you get PEView?
@dheerkv9098
7 ай бұрын
Hi @huskyhacks ! Thank you for sharing the video. I am unable to get Fireeye Flare-vm, it it mandiant/Flare-vm ?
@huskyhacks
7 ай бұрын
Yes, it's now hosted under the Mandiant org on GitHub
@saisumanthsrivatsa6772
Жыл бұрын
Can you please explain how to differentiate between qakbot and emotet
@javierarocho1222
Жыл бұрын
remnux@remnux:~$ sudo mkdir /media/cdrom remnux@remnux:~$ sudo mount /dev/cdrom mount: /dev/cdrom: can't find in /etc/fstab. I cant seem to get past this
@huskyhacks
Жыл бұрын
📺 Installing REMnux Around the 21:33 mark of the video, I start issuing commands to install the VirtualBox VM Tools on REMnux. In newer distros of REMnux, the VM Tools are installed automatically! So you may not have to issue the CD-ROM mount commands and run the auto-installer script.
@RebelledGeek
Жыл бұрын
Had the same problem. Thank you
@percysoto3823
Жыл бұрын
Insert the guest CD-ROM (VirtualBox Guest Additions installation) as you did in Windows to achieve a better screen resolution.
@ricorobinson3954
Жыл бұрын
@@huskyhacks Thank you for clarifying, this may be worth pinning for people such as myself who see this in the far future.
@repairstudio4940
5 ай бұрын
Man thank you this has been amazing. Liked and Subbed and going to recommend your channel. 💙💻🦠😎
Пікірлер: 144