Ransomware: Creation, Detection, and Response
summary
A Golang ransomware called Ironcat is built for training and accidentally leaked; it encrypts files with AES, drops a spoofed ransom note and batch backdoors, deletes VSS and event logs, and sends a Base64 key in an HTTP request. Static string and Yara signatures initially trigger many AV engines (up to ~52 detections) but small edits—changing ransom text, function names, using -trimpath, removing old backdoor code—reduce detections to a dozen then to zero on major engines. Sandbox evasion via required CLI arguments and string-focused detection is exposed; a tool called Revenant parses Windows firewall logs into Elastic for IR and mapping.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 4:35What was the ransomware
- 12:00Detection
- 13:42Detections
- 16:46Detected
- 17:15Change ransom note
- 17:47Windows Defender detection
- 21:35YARA Signature
- 22:56Virus Total
- 26:10Behavioral Detection
- 27:39Response
- 35:05Prevention
- 35:50Next Steps
related talks
52mRansomware 101: Get Smart Understanding Real Attacks
37mRansomware Resilience: Holistic Defense for SOC Leaders
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
32mSurviving a Ransomware Attack - Lessons from the Field
29mRendering Ransomware Detection and EDR Products Blind
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
52mRansomware; The Real Pandemic