Analyzing and Unpacking Qakbot Using Binary Ninja Automation Part 2

In this stream we continued the development of our static unpacker using Binary Ninja scripting. We then used pefile and Binary Refinery to extract the final Qakbot payload. We then stumbled across an advanced payload that we extracted using our unpacker that used indirect syscalls, that we began to analyze using binary ninja, and eventually unpacked the final PE dynamically.

Training: https://training.invokere.com/course/imbtbn
Notes: https://github.com/Invoke-RE/stream-notes/tree/main/automating-qakbot-analysis-binary-ninja
Twitch: https://www.twitch.tv/InvokeReversing
Twitter: https://twitter.com/InvokeReversing
Mastodon: https://infosec.exchange/@invokereversing

Видео Analyzing and Unpacking Qakbot Using Binary Ninja Automation Part 2 канала Invoke RE