Live Stream VOD: Rhadamanthys Part 1 - Stage 1 Shellcode and Shifted Pointers
Added 2023-01-26 19:25:16 +0000 UTCIn this twitch stream we take a look at Rhadamanthys, a stealer malware that uses multiples stages of shell code to protect its payload.
We start out unpacking the first stage but end up spending a lot of time trying to make a simple PEB walk look nice in IDA using Shifted Pointers. This is one tip that we shouldn't soon forget!
Sample
dca16a0e7bdc4968f1988c2d38db133a0e742edf702c923b4f4a3c2f3bdaacf5
Notes
PEB Walk _LDR_DATA_TABLE_ENTRY and Shifted Pointers in IDA
Comments
<3<3<3
Karsten Hahn
2023-02-13 04:16:21 +0000 UTC
