Tropical Live Stream VOD: Zharkbot Dynamic Analysis
Added 2024-09-07 14:00:08 +0000 UTCIn this live stream we take a different approach to analyzing the annoying string encryption in Zharkbot; dynamic analysis!
Sample
1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109 [UnpacMe]
Notes
Zharkbot Strings - Extracting strings from this downloader
Comments
Thank you!
Karsten Hahn
2024-10-09 14:09:21 +0000 UTCAh shoot! Pastebin sucks! Luckily I was able to recover it from my IDB, uploaded here: https://gist.github.com/herrcore/2b8132b5e865a72d2006a3b34e155915
OALABS
2024-10-09 05:04:45 +0000 UTCThe script for SSE patching is not available on pastebin anymore. Can you share it again?
Karsten Hahn
2024-10-09 03:53:46 +0000 UTCHaha, the second time I load the explert.exe from tmp folder, and try to log the decrypted strings ...but not reveal the C2 address like your vid , bro :)). Try to figure out .... but dont know why :)). Nice vid!! Tks so much!
m4n0w4r
2024-09-16 07:47:48 +0000 UTC
