Reversing WannaCry Part 1 - Finding the killswitch and unpacking the malware in #Ghidra
1,346,346
Published 2019-03-27
In this first video of the "Reversing WannaCry" series we will look at the infamous killswitch and the installation and unpacking procedure of WannaCry.
Twitter: twitter.com/ghidraninja
Links:
- Interview with MalwareTech: soundcloud.com/arrow-bandwidth/s3-episode-11-wanna…
- MalwareTech's blogpost about the killswitch: www.malwaretech.com/2017/05/how-to-accidentally-st…
Further reading
- Wikipedia: en.wikipedia.org/wiki/WannaCry_ransomware_attack
- LogRhythm Analysis: logrhythm.com/blog/a-technical-analysis-of-wannacr…
- Secureworks Analysis: www.secureworks.com/research/wcry-ransomware-analy…
All Comments (21)
-
Reverse engineering enhances the understanding of both programming thought and skills. This video is easy to follow, and the main techniques of reverse engineering are shown clearly, which makes me want to decompile a small interesting program to analyze it.
-
"Microsoft security center (2.0) sevice" LMAO
-
Looks like Ghidra is a very good renaming tool!
-
I'm a vegetable that doesn't understand anything but this was an interesting video
-
Ghidra ninja:The function is very simple Me:
-
Wow that was probably one of the best descriptive reverse engineering videos I've seen to date. Your method of explaining and showcasing each step in each function is fantastic and even explaining how to identify when disassemblers/decompilers mess up and how to fix them. Bravo. I'm upset that I waited this long to actually start watching these videos.
-
Love this! Please create a series of Reverse Engineering Basics!
-
I didn't understand anything of what you did, but the casualness of explaining something so exoticly complicated drew me in.
-
This was SUPER interesting and well made, please continue! You left us on a cliffhanger!
-
Very interesting and complete video, first time I watch a reversing engineering video and I love the way you investigate and explain what you do. It's the first video of your channel I see and I love it. Keep going !
-
I came across your channel shortly after downloading Ghidra. I appreciate how you clearly detail your train of thought in each video. I hope to see more!
-
Really well done video. I think you should keep this series in this format. Personally I like the pacing of the video, and wouldn't want it slower, or faster.
-
WannaCry: exists Ghidra: im about to end this mans whole carrer
-
I understood everything except for the renaming parts. Meaning i did not understand a thing. Cool vid tho, you've earned a sub!
-
Using an open source reversing platform like Ghidra, everyone could potentially come closer to the reversing world. Oh what if I could be some years younger..
-
Fantastic Video, I hope to see more both on wannacry and other things soon. As an embedded SW guy looking to get into RE this was great.
-
everyone: try not downloading files from entrusted places!!! Ghidra: let's unpack the malware !
-
Just wow. Impressive job! I hope you are employed by one of the major tech/AV companies.
-
Reading the WannaCry warning, the creaters were real lads, providing multiple languages, information about BitCoin and a contact method. They just sound incredibly kind.
-
You know too many things. You explain it too casually like it's food lmao. This guy be like: Ok, let me present you my house.
