Категории

This ANTIVIRUS runs MALWARE | Malware Analysis Lab (IDAT Loader Part 1)

Опубликовано: 12 Апрель 2026
на канале: Jai Minton - CyberRaiju
1,880
96

Learn about DLL Search Order Hijacking and DLL Side-Loading to understand how AV products can be used to run malware.

** Analysis Part 2 **
   • MALWARE ANALYSIS | Reversing IDAT (Hijack)...  

** Find me at **
Twitter/X -   / cyberraiju  
Blog - https://www.jaiminton.com/
Mastodon - https://infosec.exchange/@CyberRaiju

** Tools **
FLARE VM - https://github.com/mandiant/flare-vm
Notepad++ - https://notepad-plus-plus.org/
Ghidra - https://github.com/NationalSecurityAg...
Detect-It-Easy - https://github.com/horsicq/Detect-It-...
pestudio - https://www.winitor.com/download
HxD - https://mh-nexus.de/en/hxd/

** Samples **
https://www.virustotal.com/gui/file/a...
https://www.virustotal.com/gui/file/2...
https://www.virustotal.com/gui/file/f...

* Further Reading*
https://www.rapid7.com/blog/post/2023...
https://www.mandiant.com/sites/defaul...
https://attack.mitre.org/techniques/T...
https://attack.mitre.org/techniques/T...
https://en.wikipedia.org/wiki/Bitwise...
https://en.wikipedia.org/wiki/Code_se...

** Understanding DLL Hijacking and Securing Software During Development **
https://learn.microsoft.com/en-us/win...
https://learn.microsoft.com/en-us/win...
https://learn.microsoft.com/en-us/win...

** Timestamps **
00:00 - Intro
00:10 - Understanding DLLs
00:10 - DLL Side-Loading and DLL Search Order Hijacking
00:35 - Malicious DLL in action
01:05 - DLL Search Order
01:30 - dbghelp.dll
01:45 - DLL Search Order Hijacking
01:56 - DLL Side-Loading
02:05 - WinSxS Directory
02:55 - Windows Defender ATP Sense CE
03:09 - Malicious MpGear.dll
03:22 - Comparing legitimate and malicious MpGear.dll
04:45 - Comparing differences in Ghidra
06:20 - TL;DR on IDAT Injector
06:49 - Locating malicious code to be injected
07:17 - Examining hidden code in hex editor
07:57 - Decrypting IDAT Injector
08:53 - Understanding Injection Commonalities
09:07 - How the malicious DLL runs code
09:40 - Examining code strings
10:17 - Outro

Credits:
SFX by Pixabay
Reports by Mandiant and Rapid7

play_arrow
115
1

A RAINBOW GAME(ODD RAINBOW )

A RAINBOW GAME(ODD RAINBOW )
play_arrow
127
2

Предсказания Ванги

Предсказания Ванги
play_arrow
230,046
11 тыс

Shoulder Boulders ♡ Animation Meme

Shoulder Boulders ♡ Animation Meme
play_arrow
697
7

Простой способ очистить подвал от вредителей и болезней - дымовая шашка Бомбер

Простой способ очистить подвал от вредителей и болезней - дымовая шашка Бомбер
play_arrow
4,307
574

КРАШ💗💗

КРАШ💗💗

play_arrow
17,560
508

B♡mbshell Bl♡nde ♡ Valentines Special ♡ AMV

B♡mbshell Bl♡nde ♡ Valentines Special ♡ AMV
play_arrow
594
38

Конец BMW

Конец BMW
play_arrow
974,550
15 тыс

Scarlett Johansson Vs Interviewer

Scarlett Johansson Vs Interviewer

Похожие видео
play_arrow
MALWARE on a BLOCKCHAIN! | Malware Analysis of ClearFake hosed on hacked WordPress sites

MALWARE on a BLOCKCHAIN! | Malware Analysis of ClearFake hosed on hacked WordPress sites
play_arrow
MALWARE on GitHub | `Cracked Software` Reverse Engineering via Debugging, FLOSS, and API monitoring

MALWARE on GitHub | `Cracked Software` Reverse Engineering via Debugging, FLOSS, and API monitoring
play_arrow
MALWARE on WordPress site | LNK file MALWARE ANALYSIS and HTA Deobfuscation

MALWARE on WordPress site | LNK file MALWARE ANALYSIS and HTA Deobfuscation
play_arrow
Homebrew MacOS MALWARE! | Decrypting Cuckoo Stealer using Python

Homebrew MacOS MALWARE! | Decrypting Cuckoo Stealer using Python
play_arrow
Backdoored WASABI WALLET | Reverse Engineering a malicious MSI and Java Archive Malware Downloader

Backdoored WASABI WALLET | Reverse Engineering a malicious MSI and Java Archive Malware Downloader
play_arrow
Malware Analysis | AsyncRAT Injector | AES Decryption with CyberChef, and ISO File Forensics

Malware Analysis | AsyncRAT Injector | AES Decryption with CyberChef, and ISO File Forensics
play_arrow
MALWARE ANALYSIS | Reversing IDAT (Hijack) Loader / Injector using x32dbg, Ghidra, and IDA

MALWARE ANALYSIS | Reversing IDAT (Hijack) Loader / Injector using x32dbg, Ghidra, and IDA
play_arrow
This ANTIVIRUS runs MALWARE | Malware Analysis Lab (IDAT Loader Part 1)

This ANTIVIRUS runs MALWARE | Malware Analysis Lab (IDAT Loader Part 1)
play_arrow
Stealthy MSIX MALWARE | Malware Analysis (FakeBat)

Stealthy MSIX MALWARE | Malware Analysis (FakeBat)
play_arrow
UNDETECTED Discord MALWARE | Reverse Engineering Duvet Stealer, Electron Malware Used By HACKERS

UNDETECTED Discord MALWARE | Reverse Engineering Duvet Stealer, Electron Malware Used By HACKERS
play_arrow
Malware in a PICTURE! | Reverse Engineering an XWorm Loader that uses STEGANOGRAPHY

Malware in a PICTURE! | Reverse Engineering an XWorm Loader that uses STEGANOGRAPHY
play_arrow
Create YARA rules with GHIDRA | MALWARE Analysis of Havoc Demon implants

Create YARA rules with GHIDRA | MALWARE Analysis of Havoc Demon implants
play_arrow
.NET Malware Analysis | Reversing the Dark Tortilla Crypter

.NET Malware Analysis | Reversing the Dark Tortilla Crypter
play_arrow
SVCHOST MALWARE recruits you into a botnet | BlackNET RAT deep dive malware analysis

SVCHOST MALWARE recruits you into a botnet | BlackNET RAT deep dive malware analysis
play_arrow
Single Player Game Hacking 101 | Becoming a BILLIONAIRE by manipulating FFVII memory and save games

Single Player Game Hacking 101 | Becoming a BILLIONAIRE by manipulating FFVII memory and save games
play_arrow
Static and Dynamic MALWARE ANALYSIS | Agent Tesla from an AutoIT EXE

Static and Dynamic MALWARE ANALYSIS | Agent Tesla from an AutoIT EXE
play_arrow
Bypassing a DUMB, Endpoint Detection and Response (EDR) Tool

Bypassing a DUMB, Endpoint Detection and Response (EDR) Tool
play_arrow
SECRETS of Scheduled Tasks | How TARRASK MALWARE hides Scheduled Tasks from security teams

SECRETS of Scheduled Tasks | How TARRASK MALWARE hides Scheduled Tasks from security teams
play_arrow
PowerShell MALWARE that STEALS my clipboard | Webhook Clipper Malware Analysis

PowerShell MALWARE that STEALS my clipboard | Webhook Clipper Malware Analysis
play_arrow
FIX corrupted archives with 010 Templates

FIX corrupted archives with 010 Templates
play_arrow
Android Malware steals PRIVATE browsing history! | Reverse Engineering ANDROID MALWARE

Android Malware steals PRIVATE browsing history! | Reverse Engineering ANDROID MALWARE
play_arrow
Malware Analysis of .NET Information Stealers | Snake Keylogger

Malware Analysis of .NET Information Stealers | Snake Keylogger
play_arrow
This is the most popular HACKING TOOL! | Cobalt Strike Stager Malware Analysis

This is the most popular HACKING TOOL! | Cobalt Strike Stager Malware Analysis
play_arrow
Fortnite hackers, GET HACKED? Redline Stealer MALWARE ANALYSIS

Fortnite hackers, GET HACKED? Redline Stealer MALWARE ANALYSIS