oalabs
patreon
Live Stream VOD: SmokeLoader Analysis Part 3 - Stage 3 Decrypted and Config Extracted
🕑 Added 2022-09-03 04:37:38 +0000 UTCThe conclusion to our analysis of SmokeLoader! All the secrets are revealed and it's grrr-eat! We finally figure out the missing piece for the API hashes and resolve them. This leads us to the missing piece of the puzzle for extracting Stage 3 - LZSA2 decompression!
Once we have decrypted and decompressed Stage 3 we quickly locate the encrypted strings table, and the encrypted C2 table building ourselves a static config extractor!
This was a pretty triumphant conclusion if I do say so myself : )
Samples
- Packed parent cef4f5f561b5c481c67e0a9a3dd751d18d696b61c7a5dab5ebb29535093741b4
- Unpacked SmokeLoader 041a05dd902a55029449bf412cedbe59a593f8d4e67d4ae37cf7a928c92f22ca
Notes
Comments
OALABS
You tell me : ) That's actually a good exercise for becoming more familiar with HashDB and API hashing in general.
m4n0w4r
End of this live stream, until now you still not implement smoke loader hash function in hashdb rite :D ? Correct me if I'm wrong :P
