oalabs
patreon
Tropical Live Stream VOD: Dynamic Python Deobfuscation Attacking The Interpreter
🕑 Added 2024-09-01 01:24:13 +0000 UTCIn this live stream we analyze an unknown python stealer that comes bundled as a PyInstaller, but instead of static analysis we opt for dynamic analysis with x64dbg!
Sample
2a19ba63e85ce75d5f2d884011dfc94f616b176ed89a67c1acc0fe2179e8b591 [UnpacMe]
Notes
Python Hunting - Triaging this unknown python stealer with some breakpoints
Comments
Ilia Mandjukov
x64dbg was not stopping for me either. I believe the case was because my python was slightly older version and instead of using PyParser_ASTFromString it was using another function. I didn't dig deep enough to see which one though...
OALABS
That's not enough info to help you troubleshoot, hop on discord and dump all the info you can. Maybe we can figure it out. Best guess right now is that you are using an old version of x64dbg? SANS version maybe?
recon2024
This trick didnot worked well for me, may be bug in x64dbg. Was unable to log nor debugger was stopping at breakpoint sometimes.
Karsten Hahn
Haha, thanks as well! I just watched it today
OALABS
Yeh man!! Nice work!
m4n0w4r
Hell yeah!! Thanks for giving me shout out :)) And as always, nice stream and nice trick!!!
