Malware Analysis - Decrypt NighHawk Strings with Ghidra Scripting

Ghidra makes scripting very easy. Here it helps us to deobfuscate strings in a NightHawk malware sample.

Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel
Sample: https://bazaar.abuse.ch/sample/9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8/
C++ Strings layout: https://joellaity.com/2020/01/31/string.html

00:00 Intro
01:11 Finding the decryption function
06:17 Creating a proper C++ string type
12:20 Understanding the decryption function
17:14 Writing the script
24:58 Running the script & cleaning mistakes

analysis decrypt ghidra malware malware analysis scripting strings