Live Steam VOD: PyInstaller Malware Triage - Creal Stealer
Added 2024-05-21 01:51:57 +0000 UTCIn this live stream we triage Creal Stealer, a Python stealer which has been packed with PyInstaller. We cover the differences between Python byte code disassembly and decompiling as well as provide a few tips for decompiling newer versions of Python.
Shout out to Karsten for his YouTube short which covered the same topic in 30 sections instead of an hour... go sub you you aren't already! Reversing PyInstaller in 6 Steps
Sample
21a9b4859121afcf6690c2c15b795094986c0a20c36a356c3915f107ec41f67a UnpacMe
Notes
Python Malware Triage: Creal Stealer - A Few Tips To Help With PyInstaller And Friends
Comments
Got it! So amazing ...
m4n0w4r
2024-05-28 15:15:58 +0000 UTChttps://pylingual.io/ might work
Karsten Hahn
2024-05-28 14:07:50 +0000 UTCFound a sample: 68754B8B2B5775692C5AD9D53A041848AB02701B660EC457EAB3E2B039849864. Your patched pycdc will crash when trying decompile the last marshal pyc stage. Could you take a look if you have free time @herrcore
m4n0w4r
2024-05-28 07:19:59 +0000 UTCThanks for taking my request :)
Chaitanya Ghorpade
2024-05-23 07:43:44 +0000 UTC
