Skip to content
Hallway
0:00 / 0:00

#emotet#x64dbg#pe-bear

Unpacking Emotet / Geodo (Stage 1) Using x64dbg - Subscriber Request

OALabs

52K subscribers • 40 videos on Hallway

YouTube
  • Recommended by 1 person: 1 in engineering communities.
  • Linked in the descriptionOALabs/PyIATRebuild

Intermediate. Assumes working knowledge.

27K views8 years ago1 recommendation

SecurityReverse engineering

OALabs demonstrates how to unpack the first stage of the Emotet malware using x64dbg and PE-bear.

Open Analysis Live! We use x64dbg to unpack a new Emotet / Geodo malware (Stage 1). This was a subscriber request asking us to determine how this was packed. ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- Packed sample: Sha256: c41cbad1ee87b9156c389962608cf25570ca176903b299cb3415f3fc3a23ebbe malshare.com/sample.php?action=detail&hash=90c2c10001134ab2a… x64dbg: x64dbg.com/#start PE-bear: hshrzd.wordpress.com/pe-bear/ PyIATRebuild: github.com/OALabs/PyIATRebuild Unpacked (stage 1): c3f43896913c17f91c0d95924ac426e89928b8eef93da7dc107a7a0891c7a860 malshare.com/sample.php?action=detail&hash=01e0cf87ee2e22ff4… Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net

Why it's here

1 person recommends this

What people say. Recommended as a practical walkthrough of unpacking Emotet malware using x64dbg.

u/herrcorein r/ReverseEngineering • Recommends

Unpacking Emotet / Geodo malware using x64dbg and PEBear
54View on Reddit