+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: BeatRev - POC For Frustrating/Defeating Malware Analysts (/showthread.php?tid=6223656)
BeatRev - POC For Frustrating/Defeating Malware Analysts - ĐĮΜĘ - Oct 6, 2022
The first time the malware runs on a victim it AES encrypts the actual payload(an RDLL) using environmental data from that victim. Each subsequent time the malware is ran it gathers that same environmental info, AES decrypts the payload stored as a byte array within the malware, and runs it. If it fails to decrypt/the payload fails to run, the malware deletes itself. Protection against reverse engineers and malware analysts.
Check it out: https://github.com/Octoberfest7/BeatRev
RE: BeatRev - POC For Frustrating/Defeating Malware Analysts - NotKover - Oct 6, 2022
(Oct 6, 2022 07:34 PM)ĐĮΜĘ Wrote: The first time the malware runs on a victim it AES encrypts the actual payload(an RDLL) using environmental data from that victim. Each subsequent time the malware is ran it gathers that same environmental info, AES decrypts the payload stored as a byte array within the malware, and runs it. If it fails to decrypt/the payload fails to run, the malware deletes itself. Protection against reverse engineers and malware analysts.
Check it out: https://github.com/Octoberfest7/BeatRev
Cool find, i thought about making something similar for my loader but i felt it unnecessary