Unpacking

Unpacking malware

Unpack RedLine stealer using dnSpyEx – Part 3

February 12, 2024

.NET, Config, Debugging, dnSpyEx, Infostealer, Malware Series, RedLine

In this article, we dive into process of unpacking and extracting config from RedLine Stealer using dnSpyEx. It’s a bit lengthy but a great way to learn about the unpacking process using dnSpyEx. 🔍 This is the 3rd part in our deep dive series on RedLine. If you need a…

Unpack RedLine stealer to extract config using pe-sieve -Part 2

February 6, 2024

.NET, dnSpyEx, Infostealer, Malware Series, pe-sieve, ProcMon, RedLine

RedLine Stealer config extraction using two ways: Fast & Easy Method: Use the awesome pe-sieve tool from @hasherezade, which dumps unpacked file from memory. Then, extract the config from dumped file. Using dnSpyEx for manual debugging. It’s a bit lengthy but a great way to learn about the unpacking process.…

Unpacking Pyrogenic/Qealler using Java agent -Part 0x2

January 17, 2020

Bytecode Viewer, Infostealer, Java, Java agent, Pyrogenic, Qealler

We will learn how and when we can use Java agent to quickly unpack the Pyrogenic Infostealer. In the earlier post Pyrogenic Infostealer static analysis – Part 0x1 we statically analysed the Pyrogenic/Qealler Infostealer but this requires more time and effort. We will be using the same sample PaymAdviceVend_LLCRep.jar from…