Unpacking GlobeImposter Ransomware With x32dbg

Open Analysis Live! In this tutorial we unpack a new version of GlobeImposter ransomeware using the X32bg / X64dbg debugger.

-----
OALABS DISCORD
https://discord.gg/6h5Bh5AMDU

OALABS PATREON
https://www.patreon.com/oalabs

OALABS TIP JAR
https://ko-fi.com/oalabs

OALABS GITHUB
https://github.com/OALabs

UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/

-----

Original packed sample:
https://malshare.com/sample.php?action=detail&hash=612974dcb49adef982d9ad8d9cbdde36

Malware Traffic Analysis sample:
http://www.malware-traffic-analysis.net/2017/11/30/index.html

The x64bdg debugger:
https://x64dbg.com/#start

The unpacked sample:
https://malshare.com/sample.php?action=detail&hash=5a5e32203cf8eee1b7e9125b1c97ed94

OAPivot the chrome plugin for IOC searching:
https://chrome.google.com/webstore/detail/oapivot/nenjokibennmmllmdbifnmmgipppnfbm

Great blog on unpacking an earlier version of GlobeImposter:
http://www.vkremez.com/2017/08/lets-learn-how-to-unpack-globeimposter.html

Video explaining some anti-debugging tricks:
https://youtu.be/WlE8abc8V-4

Anti-debugging cheat sheet (PDF):
http://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf

*Special hat-tip to Alex for recommending x64dbg and showing me some tricks: https://twitter.com/nullandnull

Feedback, questions, and suggestions are always welcome : )

Sergei https://twitter.com/herrcore
Sean https://twitter.com/seanmw

As always check out our tools, tutorials, and more content over at http://www.openanalysis.net

Видео Unpacking GlobeImposter Ransomware With x32dbg канала OALabs