3 ms·
As far as the 3 first stages are concerned that article adds little to what has been known for 2 weeks. Just a nice write-up with flow charts. But the analysis
by usr1106 3y ago
As far as the 3 first stages are concerned that article adds little to what has been known for 2 weeks. Just a nice write-up with flow charts.
But the analysis of the binary in that detail seems new to me.
So how has the source code shown there been produced? Running a disassember, understanding what the code does and renaming everything to descriptive names? That looks quite like quite an achievement in 2 weeks.
- r721 3y ago>Authors GReAT >Global Research & Analysis Team, Kaspersky Lab https://securelist.com/author/great/ https://securelist.com/author/great/ The article is apparently authored by malware analysis team from Kaspersky Lab, so they are probably quite good at reverse engineering binaries.
- usr1106 3y agoSure. But that does not answer any questions about their tooling or methods. Considered a business secret? They present the readable C code of the binary payload like it has appeared just out of the blue.
- saagarjha 3y agoThey're using IDA Pro, with names that they presumably came up with themselves by analyzing what the code does.
- giantpotato 3y agoThe tool used in those white screenshots is called IDA pro, a decompiler. https://hex-rays.com/ida-pro/ https://hex-rays.com/ida-pro/