In this Twitch stream we unpack a VMProtect "soldier" implant developed by HackingTeam. Once we have unpacked the payload we write a static config extractor using Python.
Packed sample: 76840fa18df8764afb51f1aa6da10ff65f1bdfe434dc988917380fa31fbe3a73
Detailed notes are available on GitHub in our Lab Notes.