oalabs
patreon
Live Stream VOD: Spectre RAT Exposed
🕑 Added 2024-11-24 15:00:07 +0000 UTCIn this Twitch stream we triage Spectre RAT a commodity "implant" used in targeted e-crime intrusions. The RAT is written in C++ and we exploit some silly design choices by the developer to simplify reverse engineering!
🙉 My OBS crashed half way through the stream but I managed to recover the full VOD, apologies for the technical difficulties.
Sample
Packed
74f30466c1edb8daf729df5531e6047e69cfbcd0625fbb3df02bb655ec90c480 UnpacMeUnpacked
734a22c413872a8b5f6fc5342261b9ff2c256c1891bb258747ff000df960ce4f UnpacMe
Notes
Spectre Ops - Triage for v10 of this commodity implant
Comments
OALABS
I'm not sure I understand what you are asking? If you hop in the discord it might be easier to explain what you mean?
Amar
when it comes to detection, to cover more samples, what portion of code will be preferred for this sample
OALABS
I think this is the one you mean? But all of them are listed in the C++ RE Tutorial collection, which is probably a better reference anyway. https://www.patreon.com/collection/894522 https://gist.github.com/herrcore/21f687deec13a43709b90c4a7c26d433#file-cpp_crt_strings-cpp
Amar
could you please give that link down here of gist github to get that cppstrings.h file
OALABS
Yeh looks like it!
Chaitanya Ghorpade
Packer seems similar to one discussed here: https://malwarology.substack.com/p/malicious-packer-pkr_ce1a
