Live Stream VOD: Spectre RAT Exposed
Added 2024-11-24 15:00:07 +0000 UTCIn this Twitch stream we triage Spectre RAT a commodity "implant" used in targeted e-crime intrusions. The RAT is written in C++ and we exploit some silly design choices by the developer to simplify reverse engineering!
🙉 My OBS crashed half way through the stream but I managed to recover the full VOD, apologies for the technical difficulties.
Sample
Packed
74f30466c1edb8daf729df5531e6047e69cfbcd0625fbb3df02bb655ec90c480 UnpacMeUnpacked
734a22c413872a8b5f6fc5342261b9ff2c256c1891bb258747ff000df960ce4f UnpacMe
Notes
Spectre Ops - Triage for v10 of this commodity implant
Comments
I'm not sure I understand what you are asking? If you hop in the discord it might be easier to explain what you mean?
OALABS
2025-01-30 19:30:00 +0000 UTCwhen it comes to detection, to cover more samples, what portion of code will be preferred for this sample
Amar
2025-01-30 08:10:04 +0000 UTCI think this is the one you mean? But all of them are listed in the C++ RE Tutorial collection, which is probably a better reference anyway. https://www.patreon.com/collection/894522 https://gist.github.com/herrcore/21f687deec13a43709b90c4a7c26d433#file-cpp_crt_strings-cpp
OALABS
2025-01-29 20:23:42 +0000 UTCcould you please give that link down here of gist github to get that cppstrings.h file
Amar
2025-01-29 13:04:28 +0000 UTCYeh looks like it!
OALABS
2024-12-02 18:25:56 +0000 UTCPacker seems similar to one discussed here: https://malwarology.substack.com/p/malicious-packer-pkr_ce1a
Chaitanya Ghorpade
2024-12-02 05:31:51 +0000 UTC
