Malware Analysis - Decrypt NighHawk Strings with Ghidra Scripting
Channel: MalwareAnalysisForHedgehogs
Date: 2022-12-04

Ghidra makes scripting very easy. Here it helps us to deobfuscate strings in a NightHawk malware sample.

My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

Sample: https://bazaar.abuse.ch/sample/9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8/
C++ Strings layout: https://joellaity.com/2020/01/31/string.html

00:00 Intro
01:11 Finding the decryption function
06:17 Creating a proper C++ string type
12:20 Understanding the decryption function
17:14 Writing the script
24:58 Running the script & cleaning mistakes