Analyzing the FBI's Qakbot Takedown Code (Malware Analysis & Reverse Engineering)

🚀 Build real confidence analyzing malware. Join the waitlist. 🚀 https://go.themalwarelab.co/join 📄 Get my malware analysis template 📄 https://go.themalwarelab.co/get-template 🎥 Video Description 🎥 In this video, we analyze the FBI's Qakbot takedown code using malware analysis techniques. ⏱️ Timestamps ⏱️ 0:00 - Intro 1:21 - Shellcode analysis with Malcat 7:23 - Identify functionality with Mandiant's capa 10:41 - Analyze shellcode with Ghidra 15:35 - Debug shellcode with runsc 19:40 - Review decoded executable with PEStudio 21:07 - Code analysis to confirm how Qakbot is terminated (warning: screen flickers here for a few seconds due to a recording error) 😈 Sample: https://github.com/as0ni/youtube-file... 🔑 Password: infected Unzipped SHA-256: 7cdee5a583eacf24b1f142413aabb4e556ccf4ef3a4764ad084c1526cc90e117 Description: FBI Qakbot Takedown Code 🛠️ Tools 🛠️ Malcat: https://malcat.fr/ Ghidra: https://ghidra-sre.org/ Capa: https://github.com/mandiant/capa Capa Rules: https://github.com/mandiant/capa-rules Speakeasy: https://github.com/mandiant/speakeasy x64dbg: https://x64dbg.com/ Runsc: https://github.com/edygert/runsc 📞 Follow Anuj on LinkedIn:   / sonianuj  

Join Today
🔴 Malware Mondays Episode 05 - Using CAPA to identify capabilities in executable files
▶︎

🔴 Malware Mondays Episode 05 - Using CAPA to identify capabilities in executable files

Unpacking a Trojan with Ghidra and x64dbg
▶︎

Unpacking a Trojan with Ghidra and x64dbg

RS3 8Y: ASW + Calibration Basic Explanation by Josh @ LabordeFiles.co
▶︎

RS3 8Y: ASW + Calibration Basic Explanation by Josh @ LabordeFiles.co

How I Execute and Debug a Malicious Service (Malware Analysis)
▶︎

How I Execute and Debug a Malicious Service (Malware Analysis)

Every Level of Reverse Engineering Explained
▶︎

Every Level of Reverse Engineering Explained

Malware Evasion Techniques: API Unhooking (Malware Analysis & Reverse Engineering)
▶︎

Malware Evasion Techniques: API Unhooking (Malware Analysis & Reverse Engineering)

Classify Malware with YARA
▶︎

Classify Malware with YARA

Getting Started with dnSpyEx - Unraveling a .NET Formbook Dropper
▶︎

Getting Started with dnSpyEx - Unraveling a .NET Formbook Dropper

Deciphering Obfuscated JavaScript Malware
▶︎

Deciphering Obfuscated JavaScript Malware

How To Build Your Malware Analysis Lab In 2026
▶︎

How To Build Your Malware Analysis Lab In 2026

How I Debug DLL Malware (Emotet)
▶︎

How I Debug DLL Malware (Emotet)

Zig 2026: No-AI Policy, $670K Foundation, Left GitHub & Why Zig Isn’t 1.0 - Andrew Kelley Explains
▶︎

Zig 2026: No-AI Policy, $670K Foundation, Left GitHub & Why Zig Isn’t 1.0 - Andrew Kelley Explains

MALWARE Analysis with Wireshark // TRICKBOT Infection
▶︎

MALWARE Analysis with Wireshark // TRICKBOT Infection

I Bought 25 Million Computer Viruses - VX Underground Malware HDD
▶︎

I Bought 25 Million Computer Viruses - VX Underground Malware HDD

Getting Started Reversing C++ Objects with Ghidra - Ghidra Reversing Tutorials
▶︎

Getting Started Reversing C++ Objects with Ghidra - Ghidra Reversing Tutorials

Decode Malware Strings with Conditional Breakpoints
▶︎

Decode Malware Strings with Conditional Breakpoints

An Introduction to Binary Ninja for Malware Analysis
▶︎

An Introduction to Binary Ninja for Malware Analysis

Practical Malware Analysis Essentials for Incident Responders
▶︎

Practical Malware Analysis Essentials for Incident Responders

Analyzing the Zeus Banking Trojan - Malware Analysis Project 101
▶︎

Analyzing the Zeus Banking Trojan - Malware Analysis Project 101

Code Reuse in Ransomware with Ghidra and BinDiff (Malware Analysis & Reverse Engineering)
▶︎

Code Reuse in Ransomware with Ghidra and BinDiff (Malware Analysis & Reverse Engineering)