oalabs
patreon
Live Stream VOD: Reverse Engineering Polyglot Dropper Malware
🕑 Added 2022-02-22 00:48:36 +0000 UTCIn this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload.
The mawlare is currently unknown. Submissions to VirusTotal indicate that the original file name was 申博公司服务器采购表.exe which roughly translates to Shenbo company server purchase form.exe
SHA256: 104bd2d33c119d007df2adbc571a3e8cfac722cf1f0b6156ba211f413905e9f4
When executed the sample downloads a polyglot jpg as a second stage from http[:]//43.129.168[.]248/xlb.jpg
Full notes can be found in our Lab-Notes
Comments
m4n0w4r
Found that may be shellcode use this code to load stage3 payload: https://github.com/fancycode/MemoryModule/blob/master/MemoryModule.c
