Скачать или смотреть Reversing in action: Golang malware used in the SolarWinds attack. Part 1

Earlier this year, Kaspersky introduced an online course on Targeted Malware Reverse Engineering from GReAT’s Senior Security Researchers. The training covered 10 real-life APT cases in several programming and scripting languages (C, .NET, Delphi, Powershell, JavaScript, C++), but questions about the Golang language kept coming up.
Indeed, Go language has become increasingly popular and widespread, even among malware authors. ​This video is the first part of a newly launched bonus track on the course, where Ivan Kwiatkowski explains how to analyze malware written in Go language on a Sunshuttle sample used in the SolarWinds attack.
In part one, Ivan covers fundamentals of the Go language​, explaining how simple Go programs work and how to analyze them. Then he switches to the reversing part, focusing on Sunshuttle’s way of obtaining configuration information.
Read a blogpost about the Tomiris backdoor and its connection to Sunshuttle https://kas.pr/6wbn
Learn more with Ivan Kwiatkowski and other GReAT experts at https://kas.pr/5v4d

00:00 – Introduction
02:24 – Golang Malware: Theory
14:07 – Reverse engineering Sunshuttle: Step 1

#KasperskyExpertTraining #TargetedMalware #MalwareAnalysis #ReverseEngineering #APT #KasperskyGReAT #ReversingWorkshop #GolangMalware #GoMalware #SolarWinds #Sunburst #Sunshuttle #Tomiris