Textbook in PDF format The dark web has a marketplace. This is what's for sale. Getting into the dark web isn’t simple. You need Tor. You need clean OPSEC. And even then, the forums worth being in don’t just let you walk through the door. The top-tier ones require vouches from established members, Bitcoin deposits, proof that you’re somebody. In 2021, Lindsay Kaye was among the first to reverse engineer and publicly disclose a new ransomware variant. She did it before the group behind it, BlackMatter, had even started operations. How? She found it by watching the dark web forums where the group was quietly recruiting affiliates. This book takes you inside that world and into the code behind the tools she found there: Raccoon Stealer—a credential stealer behind hundreds of millions of stolen passwords, and the SQL query it uses to pull them straight out of your browser TrickBot—the banking trojan that infected millions of Windows machines, and how it injects into Chrome and hooks the functions handling your banking traffic Cerberus—an Android banking trojan sold on dark web forums for $200 a month, and how it overlays a fake login page on top of your real banking app LockBit—one of the most prolific ransomware operations in history, and how it kills backup services, deletes shadow copies, and pushes a Group Policy update to every machine on the domain before encryption starts Mirai—the botnet that knocked half the internet offline in 2016, and how it’s able to find and infect new devices to expand its reach Sodinokibi/REvil and ALPHV—two of the most destructive ransomware-as-a-service operations ever, taken apart from the affiliate recruitment posts to the encryption code Disassembled code is an assembly language representation of the machine code. Machine code looks like a bunch of hexadecimal bytes to the human eye, and disassemblers can convert it to assembly code that is easier to understand. Generally, unless the malware author performed some kind of obfuscation on the machine code, such as extra byte insertion, the disassembly is fairly trustworthy, and an analyst can look at it and get an accurate understanding of the malware. Decompilation is a slightly different though related concept. Decompilation takes machine code or bytecode and converts it to a higher-level programming language, generally one that looks a lot like C/C++ or Java. For most people, reading and understanding this C-like code (or Java-like code) is much easier than perusing assembly, so having the decompilation available makes reverse engineering much easier. The decompilation generally won’t look like perfect, syntactically correct C, however. This is because the original compilation process likely performed some kind of optimization. Threat reports tell you what happened. This book shows you how. Who This Book Is For: This book might be for you if you’re looking to expand your knowledge of the cybercriminal underground and how cybercriminals operate on the forums and marketplaces within it. If you have some programming or software engineering experience but would like to learn more about malware and reverse engineering, you’ll find the case studies and exercises useful. Most involve looking at code in a variety of languages, including C, Java, C#, Rust, and Go. Although extensive experience in software engineering isn’t required, you’ll probably want to have a good grasp of how to read code and understand what it’s doing. If you already understand the reverse engineering concepts, you can use this book to explore the context behind the malicious tools you’re analyzing. The chapters will discuss how familiar code enables the tools sold on the criminal underground and why threat actors protect their investments by making reverse engineering more challenging. Contents: Introduction A Visit to the Dark Web Vulnerabilities, Exploits, and Access Malware Delivery Techniques Information Stealers Banking Trojans Packers and Crypters Command-and-Control Frameworks Post-Exploitation Toolkits Living off the Land Windows Ransomware Linux and Esxi Ransomware Lessons from the Underground Economy Exercise Solutions Index