oalabs
patreon
Live Stream VOD: Basic Malware Downloader Triage and Detection
🕑 Added 2022-06-13 04:14:19 +0000 UTCIn this twitch stream we triage two simple malware downloaders and look for common characteristics that we can use to automatically detect them. One loader turns out to be a Cobalt Strike loader and we attempt to extend our detections...
Downloader #1
9211ebf25c3cd3641451c95c50c1d3b7b2a4c53c36fa36564f3c1a177a0cda3d
Downloader #2 (Cobalt Strike)
1a10e2940151982f2ab4f1e62be6e4f53074a2ffb90c7977e16d6a183db98695
Notes (including Yara rules)
Malware Downloader Triage Notes
Comments
Goovscoov
Awesome! Looking forward to it!
OALABS
We haven't revisited them yet, but I will! I plan on doing more streams on this type of generic triage process and we will dust these off and give them a second look.
Goovscoov
Nice stream! Did you revisit the yara rules and it results as suggested at the end? Next stream dives straight into DiceLoader (also nice stream :) !). Curious if you found a solution that matches your result expectations. thnx in advance! Keep up the good work! I find it very educational.
