← Toutes les actualitésLire l'article ↗
> wake up > take a shit > get out of bed > remember colleagues hardcore malware thingie > downloa...
Synthèse
> wake up > take a shit > get out of bed > remember colleagues hardcore malware thingie > download > look inside > confused.mp4 > regular .exe, but has .exe inside of it > bonk with stick > .exe inside of it is the same .exe > .exe has itself inside of itself > only small difference > cant tell difference > confusion_intensifies.mp5 > has anti-vm code > cant get to work in emulation > written using delphi > delphi tform GUI thingy > weird af de-compilation > 16,000 functions present > most do basic stuff, like add or subtract > staticly links a bunch of random libraries > LOLWTF WHO WROTE THIS > bonk with really big stick > eventually find some good goop > new .exe randomly appears in-memory > ??? > grab from memory > c++ .exe, staticly linked > 500 functions > heavily obfuscated > has anti-code tampering in place > ??? > this in-memory .exe references 1st .exe goop > ask colleague about goop > "We discovered this Threat Actor likely created their own custom .exe encryptor and decryptor" I've been bonking this…
> wake up > take a shit > get out of bed > remember colleagues hardcore malware thingie > download > look inside > confused. mp4 > regular . exe, but has . exe inside of it > bonk with stick > . exe inside of it is the same .
exe > . exe has itself inside of itself > only small difference > cant tell difference > confusion_intensifies. mp5 > has anti-vm code > cant get to work in emulation > written using delphi > delphi tform GUI thingy > weird af de-compilation > 16,000 functions present > most do basic stuff, like add or subtract > staticly links a bunch of random libraries > LOLWTF WHO WROTE THIS > bonk with really big stick > eventually find some good goop > new . exe randomly appears in-memory > ??? > grab from memory > c++ .
exe, staticly linked > 500 functions > heavily obfuscated > has anti-code tampering in place > ??? > this in-memory . exe references 1st . exe goop > ask colleague about goop > "We discovered this Threat Actor likely created their own custom .
Source originale
t.me