oalabs
patreon
Live Stream VOD: Night Sky Ransomware FLAIR / FLIRT Signatures in IDA PRO and BinDiff With Rook Ransomware
🕑 Added 2022-01-16 00:29:40 +0000 UTCTwitch live stream VOD. We generate IDA Pro FLIRT / FLAIR signatures for the mbedtls library in Night Sky ransomware and begin reverse engineering. Once we have a nice IDB we use BinDiff to compare NightSKy against Rook ransomware and confirm they are from the same code base.
Sample available on Malshare:
8c1a72991fb04dc3a8cf89605fb85150ef0e742472a0c58b8fa942a1f04877b0
Clean unpacked payload (fixed OEP):
ff5757086c464d624f4a6674d65409fb6fa84ad5ac089583ebc994ba949458d7
Lab Notes:
