Malware Analysis - Creating a C2 URL decrypter for 3CX SmoothOperator Icons

To obtain more IoCs we analyse the second stage DLL that we decrypted in the first 3CX video. Then we create a CyberChef recipie that extracts and decrypts the C2 URLs. Afterwards we convert this recipie to a binary refinery snippet which allows us to do the same from the command line for all of the icons.

Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

Samples:
Icons: https://bazaar.abuse.ch/sample/2b5758f388027c53af132a2c7b28b3448b9869a81a5ce134c78330a3c31181f5/
3CXDesktopApp.msi: https://tria.ge/230330-3nzfjshc2s
ffmpeg: https://bazaar.abuse.ch/sample/7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896
d3dcompiler_47.dll: https://bazaar.abuse.ch/sample/11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03

Infection chain graphic: https://twitter.com/fr0gger_/status/1641668394155151366 …

3cx analysis binary command command line current cyberchef decrypter decryption dll function icon iocs key malware malware analysis recap shellcode stage url urls video