oalabs
patreon
PikaBot VOD: Part 1
🕑 Added 2023-03-12 17:52:38 +0000 UTCIn this Twitch stream we take a look at a new loader called PikaBot! This stream is dedicated to the preparation of the binary for analysis, decrypting strings, resolving dynamic imports etc.
Note* We waste the majority of this stream trying to get the DLL to load in a debugger properly. The DLL is not relocatable but for some reason the VM I am using insists on relocating it which causes it to crash. I'm still not sure why this was happening.
Samples
- Packed
67c61f649ec276eb57fcfe70dbd6e33b4c05440ee10356a3ef10fad9d0e224ef - Unpacked
05d1b791865c9551ed8da6a170eb6f945a4d1e79cb70341f589cc47bacf78cc3 - UnpacMe Analysis
Notes
Comments
OALABS
This is Sean's pet project, still a work in progress but it can save a lot of time https://github.com/idiom/stackstack
m4n0w4r
As I know, new version of Flare floss (https://www.mandiant.com/resources/blog/floss-version-2) can handle “tight strings”. If you don't mind, can I ask about the StackStack plugin you use on your stream to decode the string at 2:08:45?
