The document discusses empowering malware analysis using the IDA appcall feature, presenting its functions and applications in analyzing different malware types. Key topics include recovering API names, decrypting strings, and extracting configurations from malware like Lokibot and Emotet. It includes examples, analyses, and resources for reversing techniques, aimed at enhancing malware analysis skills.

1. Empowering Malware Analysis
with IDA AppCall
m4n0w4r
10/1/2024 1
# Security_Bootcamp_2024 #Phú_Quốc

2. #Wh0_4m_1?
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 2

3. What we will cover



10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 3

4. Summary of Appcall in IDA (1)
•
•
•
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 4

5. Summary of Appcall in IDA (2)
•
•
•
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 5

6. A simple example (1)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 6

7. A simple example (2)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 7

8. A simple example (3)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 8

9. A Great Explanation Video
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 9

10. Quote Of The Day
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 10

11. LOKIBOT
10/1/2024 11

12. LokiBot (1)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 12

13. LokiBot (2)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 13

14. Our analysis
Reversing
LokiBot
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 14

15. LokiBot Infection Chain
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 15

16. Dynamic Resolve API Functions
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 16

17. Hardcore Reverser – try hard to understand logic
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 17

18. Hardcore Reverser – reimplement code
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 18

19. Extreme Reverser – try to find lazy way
•
•
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 19

20. Recover API Name with IDA AppCall (1)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 20

21. Recover API Name with IDA AppCall (2)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 21

22. Recover API Name with IDA AppCall (3)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 22

23. Recover API Name with IDA AppCall (4)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 23

24. Result
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 24

25. 10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 25

26. Our analysis
EMOTET
10/1/2024 26

27. For those who don’t know (1)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 27

28. For those who don’t know (2)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 28

29. For those who don’t know (3)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 29

30. For those who don’t know (4)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 30

31. For those who don’t know (5)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 31

32. For those who don’t know (6)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 32

33. For those who don’t know (7)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 33

34. And Meme Everywhere…
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 34

35. For those who don’t know (8)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 35

36. From “Dong Lao” with Love
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 36

37. From “Dong Lao” with Love
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 37

38. Our analysis
Reversing
Emotet
10/1/2024 38

39. Reversing Engineering Emotet
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 39

40. Context (1)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 40

41. Context (2)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 41

42. Decrypt Strings
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 42

43. Decrypt Strings (1)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 43

44. Decrypt Strings (2)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 44

45. Decrypt Strings (3) (Pseudocode)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 45

46. Decrypt Strings (4) (Verify)
•
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 46

47. Decrypt Strings (5) (Solution?)
•
•
• 
• 
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 47

48. Recover Original Strings with IDA AppCall (1)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 48

49. Recover Original Strings with IDA AppCall (2)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 49

50. 10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 50

51. Extract C2s Configuration (1)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 51

52. Extract C2s Configuration (2)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 52

53. Extract C2s Configuration (3)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 53

54. Extract C2s Configuration (4)
• 
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 54

55. Automate Extract C2s using IDA AppCall (1)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 55

56. Automate Extract C2s using IDA AppCall (2)
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 56

57. Automate Extract C2s using IDA AppCall (3)
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 57

58. 10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 58

59. Resources
•
•
•
•
•
•
•
•
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 59

60. Resources
•
•
•
•
•
•
•
•
10/1/2024 Empowering Malware Analysis with IDA AppCall Feature 60

61. End…
10/1/2024 61