Analyzing Windows Malware on Linux: Getting Started Tips and Examples
summary
Shows step‑by‑step Linux-first malware triage using REMnux with a real sample.exe (SHA‑256 provided), starting with TrID/file and ClamAV that flags it as ClamAV identified "Shyape", then peframe/pecheck to extract a suspicious overlay and strings, signsrch finding RSA artifacts, XORSearch/brxor and FLOSS decoded 31 strings including hard‑coded URLs (XOR key 0x56), emulation with binee/qltool/capa that flags GetTickCount anti‑debugging, and retdec/Ghidra decompilation—practical demos and exact commands included.
AI-written summary · about
chapters (11)
- 0:00Start
- 7:35Examining Static Properties of a Suspicious File
- 13:08Risky Api Calls
- 16:06Ascii Strings
- 20:54Xor Search
- 28:03What Have We Learned
- 29:25Code Emulators
- 31:32Ql Tool
- 36:46Takeaways
- 37:46Network Interactions
- 38:43Follow-Up Steps
related talks
33mBasic Malware Analysis for Incident Responders
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
01h 03mThe Dark Side of Malware Analysis
45m"Advanced Malware Threat: handling obfuscated code using..."
56mAutomating Linux Malware Analysis Using Limon Sandbox
25mCommSec D1 - A Deep Dive Into Malicious Documents
22mMalware Hunting - Using python as an attack weapon
47mDetecting and analyzing files-less malware