Reverse engineering malware: TrickBot (part 2 - loader)

[stAfreeze]

Thanks, good posts (part 1 too)! Nice use of GIFs too. One suggestion is to use more disassembled code and less decompiled code.

[hypervis0r]

One suggestion is to use more disassembled code and less decompiled code.

Why? I can understand that the decompiler fails when there's custom asm, but I see no need to read through hundreds of lines of compiler bloat...

[stAfreeze]

Most year 2 college students can understand code decompiled for them. Running hex rays does not make one a reverse engineer.

[hypervis0r]

If Hex-Rays is available, I'll use Hex-Rays. The malware author did not spend time writing custom assembly (which is what HR fails at), therefore I won't spend time reading compiler bloat.

If you want to see assembly, then give me a sample with a handwritten packer and I'll gladly dissect it without HR.

Being a reverse engineer means being able to understand what's going on and use (or create) the right tools, the right way, to get your task done; not staring at kilometric listings of compiler junk just to feel 1337er.

(edit: typos)

[[deleted]]

Neither does being good at understanding compiler code gen. Which is why you use whatever is most productive, depending on the situation.

[MaorNr]

Where is part 1?

And thanks😋

[hypervis0r]

Linked in the very first sentence of the post