Live Stream VOD: DbatLoader Analysis
Added 2022-09-22 16:40:57 +0000 UTCIn this twitch stream we take a look at dbatloader, a simple Delphi downloader that is used to download and execute other malware. This would be a straightforward analysis except the binary is written in Delphi and requires a lot of time to untangle... jump ahead to around 3:30 to get to the part where we begin to make progress.
Sample
dc5ec82e7cb2590ae612a2dd7203ae3a81662707377f2be44c94378ef0b0d3b0
Notes
Comments
For Delphi binaries, we can use IDR to analyze and generate .map file. Then, use https://github.com/mefistotelis/ida-pro-loadmap to load generated .map file to our IDB.
m4n0w4r
2023-04-20 01:22:00 +0000 UTCLol sometimes it's just like that 😅
OALABS
2023-04-18 18:24:20 +0000 UTCHaha, I hear many F**k and Sh*t in this stream...but thanks, this help me write a script to decrypt stage3 payload of the recent Dbatloader. And finally, I also hate Delphi binary :)))
m4n0w4r
2023-04-18 15:49:03 +0000 UTCI'm just jealous haha
OALABS
2023-03-10 04:01:30 +0000 UTCHaha, I randomly watch a video and there you are telling everyone you like my beard <3 Thanks for everything.
Karsten Hahn
2023-03-10 03:37:15 +0000 UTC
