Malware Analysis - 3CX SmoothOperator ffmpeg.dll with Binary Ninja

We analyze the trojanized ffmpeg.dll that was used in the supply chain attack called SmoothOperator. Me mark up the decompiled code in Binary Ninja and decrypt the next stage.

Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

Tools:
Binary Ninja: https://binary.ninja/
PortexAnalyzerGUI: https://github.com/struppigel/PortexAnalyzerGUI/releases/tag/0.12.9
Sysinternals: https://learn.microsoft.com/en-us/sysinternals/downloads/stringsSamples:ffmpeg: https://bazaar.abuse.ch/sample/7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896

d3dcompiler_47.dll: https://bazaar.abuse.ch/sample/11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03

00:00 Intro
00:36 Bleepingcomputer article
03:03 3CXDesktopApp.msi unpacking
03:50 Finding the malicious code
09:00 Marking up the code in Binary Ninja
19:24 Certificate parser markup
30:51 Decryption function
33:31 Unpacking …

3cx 3cxdesktopapp analysis article attack binary binary ninja bleepingcomputer called certificate code decrypt decryption dll ffmpeg function malicious malware malware analysis mark markup msi stage supply supply chain supply chain attack tools unpacking