This script will search in NightHawk samples for the decode function and the substitution alphabets, then decode strings referenced by the decoder function, then add the plaintext strings as comments to IDA.
In IDA it looks like this:
Tested on IDA 8.1 with the following NightHawk samples:
bazaar.abuse.ch
bazaar.abuse.ch
This article was of great help for NightHawk analysis: Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice | Proofpoint US
The IDAPython script is in my repo: hedgehog-tools/nighthawk_str_decoder.py at main · struppigel/hedgehog-tools
In IDA it looks like this:
Tested on IDA 8.1 with the following NightHawk samples:
MalwareBazaar | Checking your browser
MalwareBazaar | Checking your browser
This article was of great help for NightHawk analysis: Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice | Proofpoint US
The IDAPython script is in my repo: hedgehog-tools/nighthawk_str_decoder.py at main · struppigel/hedgehog-tools
