Using CyberChef To Automatically Extract Shellcode from PowerShell Loader [Twitch Clip]

preview_player
Показать описание
How to automatically extract the shell code from a multi-stage PowerShell loader (Cobalt Strike) using CyberChef!

See the full stream, including our analysis of the shell code...

-----
OALABS PATREON

OALABS DISCORD

Twitch

OALABS GITHUB

UNPACME - AUTOMATED MALWARE UNPACKING
-----
Рекомендации по теме
Комментарии
Автор

A video on the shellcode analysis would be great :)

sarjupatil
Автор

Just had to analyze this sample in SANS FOR610 training. Very nice sample.

wavefront
Автор

I see - the image translators work FOR the loading construct.

YouveBeenCabadged
Автор

i like this your videos a lot.. buy pls change never again the Background colors on chyberchef🤣

ciaobello
Автор

Feature request for CyberChef - Shellcode emulator 😂

Cyberconman
Автор

Could you tell me what the next step would be once you get the shellcode? I had something similar recently where i got the shellcode from doing all the decoding, but ida refused to disassemble it properly since it's not an executable. The only way i was able to disassemble it was using cli tools.

madhavbenoi
Автор

at this point might as well just binref.

stuff