Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Using IDAPython to Make Your Life Easier: Part 6

Summary: Unit 42's sixth IDAPython post shows how to run IDA in autonomous mode with the '-A' switch, generate a new IDB with '-c', and specify a script with '-S', so samples load without a GUI. Applied to the Cmstar downloader, the script scans every non-library, non-jump function in four-instruction windows for the mov esi / pop ecx / lea edi / rep movsd sequence, finds the two obfuscated strings holding the domain or IP and the URI, and decodes them; a shell loop over the sample set with MD5 4BEFA0F5B3F981E498ACD676EB352D45 among them writes results to /tmp/output.txt.

Why it matters: Cmstar's download location is recoverable from a fixed four-instruction memcpy pattern, so a handful of samples yields the infrastructure in minutes instead of one manual IDA session per file.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related