raul.alvarez.fortinet.jpg

Malware Research Using OSINT and Open Source Tools: Empowering Everyone

Raul Alvarez

Virlock is a polymorphic file-infecting ransomware. It is capable of infecting executable files and at the same time, hold your computer hostage.
Running a single infected file is a sure way of infecting your computer all over again. That is one of the main goals of Virlock. As a ransomware, the malware makes sure that you won't be able to use your computer until you pay the ransom demand. And to make our lives, even harder, Virlock employs an on-demand polymorphic algorithm, where each and every copy of the infected executable file is different from each other. And there is more, Virlock is not only a polymorphic file-infecting ransomware. The initial set of the malware code is metamorphic in nature.
In this presentation, we will dive deep in Virlock's code to expose how it implements its metamorphic code,and how it uses an on-demand polymorphic algorithm. We will also look at how we can detect Virlock, and how we can clean an infected file.

Speaker Bio: I am a Senior Security Researcher/Team Lead at Fortinet. I am a Lead Trainer responsible for training the junior AV/IPS analysts in malware analysis and reverse engineering. 

I have presented in different conferences like BSidesVancouver, BSidesCapeBreton, OAS-First, BSidesOttawa, SecTor, DefCamp, BCAware, AtlSecCon, BSidesCalgary, TakeDownCon, MISABC, InsomniHack, ShowMeCon, CircleCityCon, and HackInParis. 

I am a regular contributor to the Fortinet blog and to the Virus Bulletin publication, where I have published 22 articles.