Live Stream VOD: in2al5dp3in4er Drops Aurora Stealer
Added 2023-05-04 06:28:53 +0000 UTCIn this Twitch live stream we unpack in2al5dp3in4er loader which is using CreateDXGIFactory to detect sandboxes based on their lack of graphics card and triage its payload Aurora Stealer.
Samples
66383d931f13bcdd07ca6aa50030968e44d8607cf19bdaf70ed4f9ac704ac4d1
Notes
in2al5dp3in4er Loader: Invalid Printer using CreateDXGIFactory graphics card g-checking sandboxes
Comments
Yes, there are some special cases. E.g. if the sizeofrawdata is larger than the virtualsize, windows loader will use the virtualsize instead. pefile has an overlay offset, you can use that.
Karsten Hahn
2023-05-18 04:06:10 +0000 UTCHaha .. Hell Yeah!! :D
m4n0w4r
2023-05-10 03:05:04 +0000 UTCYes, it should be SizeOfRawData. I recall reading an article a long time ago mentioning that this is unreliable but I can't seem to find it now so maybe I imagined it haha.
OALABS
2023-05-09 18:47:04 +0000 UTCThanks so much for nice stream! I think the code for getting the final pe size is wrong. It must be: tmp_pe = pefile.PE(data=out) pe_size = tmp_pe.sections[-1].PointerToRawData + tmp_pe.sections[-1].SizeOfRawData Regards,
m4n0w4r
2023-05-09 16:33:26 +0000 UTC
