Malware Analysis - Red Team Edition

The talk argues that red teamers should learn malware analysis, because real adversaries mostly go after data through ransomware and info-stealers rather than domain admin rights. The speaker lays out levels of analysis, from sandbox detonation and static inspection to dynamic monitoring and full reverse engineering, and urges offensive practitioners to understand the tools they run instead of relying on them.

The main demo walks through a Darkside ransomware sample. Its import table exposes only one library function, which points to runtime API resolution, and most of the code sits in an encrypted section that is decrypted when the program runs. Stepping through it in a debugger shows the code being revealed and the APIs being resolved dynamically. The talk then covers a simple reverse shell compiled and inspected the way a defender would look at it, followed by two evasion ideas: renaming suspicious functions and strings, and memory bombing to exhaust a dynamic engine's resources. Detection results were compared before and after these changes.

The closing advice is to go as deep as possible on tooling, study the indicators left in compiled output, and learn from ransomware code that other groups reuse. The speaker also stresses working with blue teams and building threat-informed simulations. Sandbox options were discussed in the Q&A, including self-hosted and cloud services.