Live Stream VOD: Reverse Engineering Polyglot Dropper Malware
Added 2022-02-22 00:48:36 +0000 UTCIn this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload.
The mawlare is currently unknown. Submissions to VirusTotal indicate that the original file name was 申博公司服务器采购表.exe which roughly translates to Shenbo company server purchase form.exe
SHA256: 104bd2d33c119d007df2adbc571a3e8cfac722cf1f0b6156ba211f413905e9f4
When executed the sample downloads a polyglot jpg as a second stage from http[:]//43.129.168[.]248/xlb.jpg
Full notes can be found in our Lab-Notes
Comments
Found that may be shellcode use this code to load stage3 payload: https://github.com/fancycode/MemoryModule/blob/master/MemoryModule.c
m4n0w4r
2023-06-21 03:02:56 +0000 UTC
