oalabs
patreon
Live Stream VOD: DbatLoader Analysis
🕑 Added 2022-09-22 16:40:57 +0000 UTCIn this twitch stream we take a look at dbatloader, a simple Delphi downloader that is used to download and execute other malware. This would be a straightforward analysis except the binary is written in Delphi and requires a lot of time to untangle... jump ahead to around 3:30 to get to the part where we begin to make progress.
Sample
dc5ec82e7cb2590ae612a2dd7203ae3a81662707377f2be44c94378ef0b0d3b0
Notes
Comments
m4n0w4r
For Delphi binaries, we can use IDR to analyze and generate .map file. Then, use https://github.com/mefistotelis/ida-pro-loadmap to load generated .map file to our IDB.
OALABS
Lol sometimes it's just like that 😅
m4n0w4r
Haha, I hear many F**k and Sh*t in this stream...but thanks, this help me write a script to decrypt stage3 payload of the recent Dbatloader. And finally, I also hate Delphi binary :)))
OALABS
I'm just jealous haha
Karsten Hahn
Haha, I randomly watch a video and there you are telling everyone you like my beard <3 Thanks for everything.
