Malware Analysis - Decrypt NighHawk Strings with Ghidra Scripting
Ghidra makes scripting very easy. Here it helps us to deobfuscate strings in a NightHawk malware sample.
Malware analysis courses: https://malwareanalysis-for-hedgehogs...
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: / struppigel
Sample: https://bazaar.abuse.ch/sample/9a5791...
C++ Strings layout: https://joellaity.com/2020/01/31/stri...
00:00 Intro
01:11 Finding the decryption function
06:17 Creating a proper C++ string type
12:20 Understanding the decryption function
17:14 Writing the script
24:58 Running the script & cleaning mistakes