Malware Analysis - Deobfuscating Loyeetro Trojan-Spy

[baziroll]

Published on Aug 16, 2017
The strings of this trojan-spy are obfuscated. We figure out that this is a monoalphabethic substitution cipher and patch the trojan to retrieve the substitution alphabet. Then we write a deobfuscation script with Python to make sense of the strings.

Follow me on Twitter: @struppigel
And MalwareBlocker: @Malware_Blocker

Unpacking Loyeetro: https://www.youtube.com/watch?v=iXY2a...
Monitoring Loyeetro (MalwareBlocker): https://www.youtube.com/watch?v=J3Whs...

Sample: https://www.hybrid-analysis.com/sampl...
x64dbg: https://x64dbg.com/
Notepad++: https://notepad-plus-plus.org/downloa...
Python: https://www.python.org/downloads/
Sysinternals Strings: https://docs.microsoft.com/en-us/sysi...

• Category
  • Science & Technology
    
• License
  • Standard YouTube License