Discover and read the best of Twitter Threads about #AgentTesla
Most recents (1)
🚨Malware Tips 🚨 - Resolving API Hashes Using Conditional Breakpoints.
By adding breakpoints and log conditions to a function that resolves api hashes, it's possible to quickly resolve api hashes in bulk.
Thread
[1/11] 👇
#Malware #AgentTesla #Ghidra #Debugging
By adding breakpoints and log conditions to a function that resolves api hashes, it's possible to quickly resolve api hashes in bulk.
Thread
[1/11] 👇
#Malware #AgentTesla #Ghidra #Debugging
[1.1/11]
Link to original sample: bazaar.abuse.ch/sample/7512be2…
Link to Full Blog: embee-research.ghost.io/agenttesla-ful…
Link to original sample: bazaar.abuse.ch/sample/7512be2…
Link to Full Blog: embee-research.ghost.io/agenttesla-ful…
[2/11] You first need to locate a function that resolves api hashes.
An example can be seen here - A giveaway is the same function is repeatedly called with hash-like values. An extra telltale sign is that each return value is cast as code (code *).
An example can be seen here - A giveaway is the same function is repeatedly called with hash-like values. An extra telltale sign is that each return value is cast as code (code *).
