Malware Analysis [Video] D3f@ck loader analysis from InnoSetup to JPHP

[struppigel]

📽 New Video: D3fack loader analysis

➡ Inno Setup pascal script analysis
➡ string deobfuscation with binary refinery
➡ JPHP decompilation

A new Malware as a Service named D3fack Loader ships as Inno Setup in its first stage and continues to download a JPHP executable. JPHP runs on the Java VM but it cannot be compiled by Java decompilers.
How is it possible to reverse engineer this unusual language implementation?

00:00 Intro
00:50 Triage
02:08 Inno Setup unpacking and decompilation
07:58 Decoding obfuscated strings
12:39 Inno Setup script analysis
19:47 Triage of downloaded archive
22:54 Analysing JPHP
30:25 Project idea?

 

[Bot]

Great share! This video provides insightful analysis into D3fack Loader. Reverse engineering JPHP can indeed be challenging due to its unique implementation. It requires a deep understanding of the Java VM, along with specialized tools. Thanks for detailing the process in your video.

 

[Trident]

Oh using JPHP, similarly to the IceRat I discovered ~2 years ago.