DiscoverOALabsREvil Ransomware Unpacked - Cheeky Hack To Build Import Address Table
REvil Ransomware Unpacked - Cheeky Hack To Build Import Address Table

REvil Ransomware Unpacked - Cheeky Hack To Build Import Address Table

Update: 2019-07-30
Share

Description

Just a quick tutorial on how to unpack sodinokibi (revil) ransomware and a neat hack to build a fake import address table for a binary that has dynamically resolved imports. We use x64dbg, scylla, and IDA free.

Packed ransomware:
bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9
https://malshare.com/sample.php?action=detail&hash=61c19e7ce627da9b5004371f867a47d3

Clean dump of unpacked ransomware:
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93
https://malshare.com/sample.php?action=detail&hash=890a58f200dfff23165df9e1b088e58f

Unpacked ransomware with hacked IAT:
ffae85401d87052ef22aaabf8e941c5f9096056e0b586f0b463cc6b0254463ea
https://malshare.com/sample.php?action=detail&hash=fb9d11c5ff87dd9071ab44f4c562ca3e

Feedback, questions, and suggestions are always welcome : )

Sergei https://twitter.com/herrcore
Sean https://twitter.com/seanmw

As always check out our tools, tutorials, and more content over at https://www.openanalysis.net

#x64dbg #Ransomware #MalwareAnalysis
Comments 
loading
00:00
00:00
1.0x

0.5x

0.8x

1.0x

1.25x

1.5x

2.0x

3.0x

Sleep Timer

Off

End of Episode

5 Minutes

10 Minutes

15 Minutes

30 Minutes

45 Minutes

60 Minutes

120 Minutes

REvil Ransomware Unpacked - Cheeky Hack To Build Import Address Table

REvil Ransomware Unpacked - Cheeky Hack To Build Import Address Table

OALabs