oalabs
patreon
Live Stream VOD: in2al5dp3in4er Drops Aurora Stealer
🕑 Added 2023-05-04 06:28:53 +0000 UTCIn this Twitch live stream we unpack in2al5dp3in4er loader which is using CreateDXGIFactory to detect sandboxes based on their lack of graphics card and triage its payload Aurora Stealer.
Samples
66383d931f13bcdd07ca6aa50030968e44d8607cf19bdaf70ed4f9ac704ac4d1
Notes
in2al5dp3in4er Loader: Invalid Printer using CreateDXGIFactory graphics card g-checking sandboxes
Comments
Karsten Hahn
Yes, there are some special cases. E.g. if the sizeofrawdata is larger than the virtualsize, windows loader will use the virtualsize instead. pefile has an overlay offset, you can use that.
m4n0w4r
Haha .. Hell Yeah!! :D
OALABS
Yes, it should be SizeOfRawData. I recall reading an article a long time ago mentioning that this is unreliable but I can't seem to find it now so maybe I imagined it haha.
m4n0w4r
Thanks so much for nice stream! I think the code for getting the final pe size is wrong. It must be: tmp_pe = pefile.PE(data=out) pe_size = tmp_pe.sections[-1].PointerToRawData + tmp_pe.sections[-1].SizeOfRawData Regards,
