Malware Analysis - C2 extractor for Turla's Kopiluwak using Binary Refinery
We create a C2 extractor for APT malware Kopiluwak. For that we need to unpack two layers of code (JScript, VBA) and remove the slight obfuscation. The sample is suitable for beginners who want to train their RE skills with JScript, VBA and C2 extraction. You find the sample download below.
Malware analysis courses: https://malwareanalysis-for-hedgehogs...
binary refinery: https://github.com/binref/refinery
oletools: https://github.com/decalage2/oletools
sample: https://bazaar.abuse.ch/sample/2299ff...
kopiluwak on malpedia: https://malpedia.caad.fkie.fraunhofer...
Follow me on Twitter: / struppigel
00:00 Intro
01:30 Triage
02:28 VBA extraction and deobfuscation
11:03 Unpack first JS layer
17:15 Prettyprint JS
19:16 Understanding the JS
20:18 Unpack the second JS layer
21:15 Prettyprint and remove slight string obfuscation
24:03 Understanding the backdoor
24:40 Writing the C2 extractor
#malware #apt #javascript #js #office #unpacking #kopiluwak #reverseengineering #malwareanalysis