Live Stream VOD: Reverse Engineering Polyglot Dropper Malware
Added 2022-02-22 00:48:36 +0000 UTCIn this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload.
The mawlare is currently unknown. Submissions to VirusTotal indicate that the original file name was η³εε ¬εΈζε‘ε¨ιθ΄θ‘¨.exe which roughly translates to Shenbo company server purchase form.exe
SHA256: 104bd2d33c119d007df2adbc571a3e8cfac722cf1f0b6156ba211f413905e9f4
When executed the sample downloads a polyglot jpg as a second stage from http[:]//43.129.168[.]248/xlb.jpg
Full notes can be found in our Lab-Notes
Comments
Found that may be shellcode use this code to load stage3 payload: https://github.com/fancycode/MemoryModule/blob/master/MemoryModule.c
m4n0w4r
2023-06-21 03:02:56 +0000 UTC
