Discover and read the best of Twitter Threads about #ChromeLoader
Most recents (1)
#ChromeLoader #malware persists via obfuscated content stored in the registry. Here's how to decode it using #Cyberchef.
1/
1/
2/ First, locate a scheduled task containing content that you suspect to be chromeloader malware. Decode the first stage using "From Base64" and "Remove Null Bytes". This will give you the first stage loader in its #decoded form.
3/ Next, check the location of the next stage in the registry. This should be near the beginning of the code.
