So, which tools I should focus on?
IDA pro or OllyDbg, x64.
Debugger and Immunity debugger and all these tools alike.
Here in this video,
I don't want to talk about static analysis completely
and dynamic analysis.
Of course, both of them are really important
in your analysis.
Dynamic analysis could be really important
for decrypting functions,
and decrypting parts of the code strings,
unpacking the malware,
and so many other things.
And static analysis is really important
to see different parts of the malware
may have go to, and maybe you have missed
in your dynamic analysis.
However, here I want to talk
about something really important
about the tools, especially IDA Pro,
IDA Pro, is not just a tool for static analysis,
it is basically a documentation tool.
It is the way to document your progress
with the malware, renaming functions and variables,
even the internal structures the malware is using.
Let's the attacker is sending a message to the malware
in a specific structure.
The command is like, "the first three bytes,
then the first parameter,
then the second parameter and so on".
This internal structure is getting sent to the malware
and the malware is dealing with that structure
in every instruction of the code
and every function in the individual subset.
You can document all of that in IDA Pro.
You can actually comment how the structure looks like
and how these instructions are communicating
and dealing with that structure.
And so many other things you can actually document
inside IDA Pro on the IDB file.
This IDB file represents all the progress
that you have made in analyzing this malware.
You can use it to collaborate with other people
in the team.
You can give them this IDB file,
you can continue from where you stopped,
from where you finished.
So they don't have to repeat the code.
Imagine doing that with OllyDbg for example.
With OllyDbg you will mostly rely
on taking snapshots, revert back to snapshots,
all of the renames or the labels
that you have wrote in OllyDbg,
were already gone when you revert back a snapshot, right?
And you will not be able to share all your VM
with somebody else to revert to snapshots
and continue from where you stopped.
If you want to return back to something
you may have missed earlier in the malware,
if you will revert back to a snapshot,
what if you don't have a snapshot?
You will have to reanalyze the malware again, from zero.
But in IDA Pro, you have all the malware analysis there,
in front of you.
Of course, you will need dynamic analysis,
or the static analysis.
There are some cases where IDA Pro can't really help you,
like really, really encrypted malware,
and you have to go through different levels
of decryption, and so IDA Pro's not the best option.
However, for most of the malwares,
and for most of the samples you'll deal with,
IDA Pro could be really helpful
and will actually be very useful for you to rely
on documenting everything in IDA Pro.
Not only that you can share it with your team,
if your through a cloud, like Crowd RE,
which was created by CrowdStrike,
or other tools that are open source
and free to actually collaborate different
collaborate with a team through the cloud.
But also IDA Pro, helps you compare different values
of the same model.
Let's say after one year another sample appeared,
from the same malware,
but it's a little bit different.
The encryption is different,
maybe there's added some functionality,
some commands have been removed, and so on.
You need to compare this to the previous sample.
All the functions that are common between them,
you can actually share all this information
from one malware to another.
All the name of the functions,
all the virables names, all the structures,
if they are still the same in the next version.
And the things that are different,
you can start digging inside them.
But, if you are doing,
if you don't have your documentation of the malware,
you will have to re-reverse the sample
again from zero.
Built in it from the beginning,
you may have some screenshots from OllyDbg,
but it wouldn't help you a lot.
And your snapshots wouldn't help you at all.
Think about it this way,
if you write software, if you write a software,
you have a great documentation,
but with this documentation that you have wrote,
it doesn't cover the source code.
Like you can't just read the source code
and say okay, I have the documentation of the software,
I will just delete all the source work.
You can't do that right?
The same, you have all that malware analysis report,
but you can't delete the IDB file,
because you may need it again
if you want to analyze a new value
or you want to share this code
with somebody else to continue in that model.
So, that's it for this video,
and see you in the next video, bye-bye.