Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Using Existing Malware to Save You Time

Summary: A Unit 42 malware analyst describes lifting the roughly 200 lines of assembly for the Reaver malware family's modified Lempel-Ziv-Welch decompression routine, found at address 0x100010B2, into Visual Studio and compiling it as a DLL that Python ctypes can call. The routine allocates a 16,512-byte dictionary buffer, and the tool handles a roughly 45,115-byte compressed blob with a seven-byte magic header (08 00 A5 04 01 12 03) found in all Reaver variants, with newer samples adding a Microsoft CAB layer first.

What you should know: Reaver's decompression can be run without executing the sample at all, so the analyst's constraint is assembly and stack knowledge rather than a sandbox - and the same technique applies to any function inside a binary.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related