Excerpt
Now, you get the original Andromeda build file. Load the unpacked sample at OllyDBG. As before, after the stack frame at the EP, you see that the malware is looking to load API's address using the PEB_LDR_DATA structure, but this time instead of kernel32.dll; the malware try to find ntdll.dll base address, then, it will parse the EAT, hash each APIs then make comparison to find the needed APIs :
Become a certified reverse engineer!
Get live, hands-on malware analysis training from anywhere, and become a Certif…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Infosec Institute on resources.infosecinstitute.com.
More from Infosec Institute5
- Netwalker malware: What it is, how it works and how to prevent itInfosec Institute · Published 29 Jul 2020
- Jackpotting malwareInfosec Institute · Published 5 Mar 2020
- Fast Flux Networks Working and Detection, Part 2Infosec Institute · Published 23 Dec 2014
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
