Live Steam VOD: RansomHouse Part 2 - PE Rebuilding
Added 2024-06-27 14:00:12 +0000 UTCThis is the second part in our analysis of RansomHouse ransomware loader. In this stream we rebuild a custom PE format used by the loader.
Sample
acf361296c9e1cf5b4ceff11e1790c57e6e1d753df9bef087aadad256dc5a123
No notes, just pure RE and chill πΉπΎ
Comments
Using IMAGE_NT_HEADERS64 instead of IMAGE_NT_HEADERS would have fixed the misaligned access to the data directory
Karsten Hahn
2024-07-29 16:32:03 +0000 UTC
