How Hackers Write Malware & Evade Antivirus (Nim)
Source: YouTube · John Hammond · published Jul 5, 2023 · 24:04
This video demonstrates creating a simple shellcode runner in Nim for Windows, described as a "hello world" equivalent for malware development 0:13.
Key Takeaways:
• The technique uses three Windows API functions: VirtualAlloc, VirtualProtect, and CreateThread 1:49
• The presenter shows importing the winim library for Windows API bindings in Nim 5:34
• Memory allocation is configured with executable and rewritable permissions for simplicity 7:02
• The code copies shellcode into allocated memory and executes it using CreateThread 10:51
• They demonstrate generating actual shellcode with Sliver and testing the runner 15:08
The video concludes with showing how to obfuscate shellcode using "HellShell" to potentially evade detection by representing it as UUIDs 17:49.
Sources:
- 0:13 Introduction to creating a shellcode runner in Nim
- 1:49 Explaining the three Windows API functions needed
- 5:34 Setting up Nim with winim library for Windows API
- 7:02 Configuring memory allocation parameters
- 10:51 Copying and executing shellcode with CreateThread
- 15:08 Testing with actual shellcode from Sliver
- 17:49 Obfuscation techniques with HellShell and UUID representation
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hello world simply outputting the string hello world is usually the first bit of code a programmer writes in a new language that they're trying to learn whether it's a new programming language a new scripting language some whole new paradigm all these things are to learn something new and in this video I want to learn and we want to learn how we could write malware maybe malicious code malicious programs and I want to showcase it in a simple hello world equivalent in my mind just simply executing Shell Code running arbitrary code and this time we're going to do it in Nim we'll be writing a simple Shell Code runner on Windows something that can execute Shell Code any code that we want all those machine operations assembly instructions that tell the processor and the computer to do something…