Matthew Profile picture
Security Research and Educational Content

Mar 14, 2023, 5 tweets

Potential #DanaBot Loader - De-Obfuscation using CyberChef and Python.

Sample: bazaar.abuse.ch/sample/80aad66…

C2: 0/90 VT
Script: 5/59 VT

[1/5] 👇

#Regex #python #cyberchef #malware

[2/5] Note the initial script contains a large amount of junk comments to mask the "real" code.

These can be removed using #cyberchef and a short #regex.

Find and Replace
^(REM|').*\n

[3/5] There are some long junk numbers scattered throughout the code.

Personally, I decoded with Python and an eval inside of a safe VM.

[4/5] An echo/print statement would also work to decode the script.

Just make sure to patch/comment the anti-debug check first.

[5/5]

#VirusTotal Links:
C2: 0/90 Detections
VBS Script: 5/59 Detections

virustotal.com/gui/file/80aad…

virustotal.com/gui/domain/mon…

Share this Scrolly Tale with your friends.

A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.

Keep scrolling