Dliv3

layout	post
title	Thoughts about automated malware unpacking
date	2020-05-08 17:00:00 -0700
categories	reverse-engineering malware-analysis
permalink	/posts/automated-malware-unpacking

Probably most of the malwares out there use some sort of packer to evade detection and classification or to make the post-analysis more difficult. So in this blog post, I will talk about one of the most-used packing techniques and how to SOMETHING_ELSE(defeat packers/ should edit) that with the power of binary emulation. Also, I'll drop a PoC of the new project that I'm working on.

	<%@ Page Language="C#" %>
	<%
	// Read https://soroush.secproject.com/blog/2019/05/danger-of-stealing-auto-generated-net-machine-keys/
	Response.Write("<br/><hr/>");
	byte[] autoGenKeyV4 = (byte[]) Microsoft.Win32.Registry.GetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\ASP.NET\\4.0.30319.0\\", "AutoGenKeyV4", new byte[]{});
	if(autoGenKeyV4!=null)
	Response.Write("HKCU\\Software\\Microsoft\\ASP.NET\\4.0.30319.0\\AutoGenKeyV4: "+BitConverter.ToString(autoGenKeyV4).Replace("-", string.Empty));
	Response.Write("<br/>");
	byte[] autoGenKey = (byte[]) Microsoft.Win32.Registry.GetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\ASP.NET\\2.0.50727.0\\", "AutoGenKey", new byte[]{});
	if(autoGenKey!=null)

	package main

	import (
	"fmt"
	"log"
	"strconv"

	"github.com/miekg/dns"
	)

	# coding=utf-8
	"""
	LICENSE http://www.apache.org/licenses/LICENSE-2.0
	"""
	import datetime
	import sys
	import time
	import threading
	import traceback
	import SocketServer

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/types.h>
	#include <sys/socket.h>
	#include <netinet/in.h>

	#define SERVER_PORT 9999

	int main() {

	#!/usr/bin/env python
	####################
	#
	# Copyright (c) 2019 Dirk-jan Mollema / Fox-IT (@_dirkjan)
	#
	# Permission is hereby granted, free of charge, to any person obtaining a copy
	# of this software and associated documentation files (the "Software"), to deal
	# in the Software without restriction, including without limitation the rights
	# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	# copies of the Software, and to permit persons to whom the Software is

	md5 4c6081f8c898d4cc7afdf77806a27d56
	sha256 7351f24f71b063f0c95f7d876ee2b395b954924bcf7d3a30f56d23254345f3b3

	md5 cd253e822337a58c6f4f65c08a789e0c
	sha256 efb0e6065bd9ab440b959553eca5389c2073e5da1f006f6d9aaa1af424a66303

	def dliveDebugStr(string):
	print('\033[32m[DLIVE DEBUG] >>> {}\033[0m'.format(string))

	def dliveDebugFunc(func):
	def wrapper(args, *kw):
	dliveDebugStr('{}.{}'.format(args[0].__class__.__name__, func.__name__))
	# for each in args:
	# dliveDebugStr('\| -- {}'.format(each))
	# for i in kw:
	# dliveDebugStr('\| -- {} => {}'.format(i, kw[i]))

	/*

	This file contains definitions used by the Hex-Rays decompiler output.
	It has type definitions and convenience macros to make the
	output more readable.

	Copyright (c) 2007-2017 Hex-Rays

	*/

Dliv3

Background