oalabs
patreon
Tropical Live Stream VOD: Latrodectus
🕑 Added 2024-10-05 14:00:12 +0000 UTCIn this Twitch stream we take a look at the new Latrodectus variant which uses AES to encrypt its strings. Instead of writing an AES string decrypter we take a generic "black box approach" using emulation to simply emulate the full decryption algorithm.
Samples
5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8
Notes (with code)
Latrodectus - Extracting new AES encrypted strings from this RAT
Comments
OALABS
I tried ida 9 but the license situation is pretty dodgy : /
m4n0w4r
Oh...haha nice man IDA 8.4!! Will you update to 9.0 :)) The AES code in this sample looks like code at: https://github.com/kokke/tiny-AES-c
