Malware Analysis - ZPAQ to .NET downloader to Injector DLL unpacking
Channel: MalwareAnalysisForHedgehogs
Date: 2023-11-05

A phishing attempt with an unusual archive format named ZPAQ leads to an interesting malware downloader. We debloat the sample and decrypt the downloaded .wav file with binary refinery. It turns out to be an injection DLL. We use powershell to execute it and deal with its obfuscation. Although the injector fails, we unpack the payload.

Tools: zpaq, DnSpy, IlSpy, binary refinery, PortexAnalyzer, HxD, SystemInformer

Malware course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=02F3FAD5E2153D4D789E
ZPAQ article: https://isc.sans.edu/diary/rss/30366
ZPAQ sample: https://malshare.com/sample.php?action=detail&hash=1c33eef0d22dc54bb2a41af485070612cd4579529e31b63be2141c4be9183eb6
.WAV file: https://malshare.com/sample.php?action=detail&hash=c2c466e178b39577912c9ce989cf8a975c574d5febe15ae11a91bbb985ca8d2e

Twitter: https://twitter.com/struppigel

00:00 Intro
01:27 Original article
02:33 Unpacking ZPAQ and debloating
05:35 Downloader analysis
09:14 Malware course
09:40 Decrypting the .wav file
11:49 injector analysis
16:38 String decryption with PowerShell
21:23 Unpacking the payload

#powershell #deobfuscation #unpacking #injection #stringdecryption #zpaq #debloat #malware #malwareanalysis #reverseengineering