kienmanowar.wordpress.comPublished
Quick analysis note about DealPly (Adware)
Excerpt
DealPly adware abuses Microsoft, McAfee services to evade detection Adware.DealPly
The post focuses on the following main sections:
Unpack wrapper/loader to get main Dll payload.
Decrypt C2url and strings are used in the malware code.
Sample:
Most of the DealPly loaders are coded in Delphi. When it runs without parameter, it only shows the following form:
When executing with parameters, it…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by kienmanowar.wordpress.com on kienmanowar.wordpress.com.
Mentioned in the excerpt
More from kienmanowar.wordpress.com2
- [QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysiskienmanowar.wordpress.com · Published 21 Jul
- Manual Unpacking IcedID Write-upkienmanowar.wordpress.com · Published 16 Aug 2020
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
