Live Stream VOD: CryptBot Malware Triage
Added 2023-03-19 01:01:09 +0000 UTCIn this Twitch stream we triage CryptBot a C++ INFOSTEALER that has been in operation since 2019.
The main focus of the stream is building a decent config extractor and a good yara rule for this malware but we have a little fun looking up its origins along the way.
Sample
7ccda59528c0151bc9f11b7f25f8291d99bcf541488c009ef14e2a104e6f0c5d
Notes
Comments
Note here for creating string struct with variable size: https://hex-rays.com/blog/igors-tip-of-the-week-94-variable-sized-structures/
m4n0w4r
2023-04-24 07:29:58 +0000 UTCππ legit cracked me up
OALABS
2023-03-23 05:53:59 +0000 UTCHaha, I should have linked this part of the twitter thread: https://twitter.com/James_inthe_box/status/1224720428502880257 My bad.
Karsten Hahn
2023-03-23 05:26:53 +0000 UTC
