Memory Dump Unpacking - Finding Redline Stealer

In part 2 of this 2 part series, we'll look at how to use memory dumps to find our unpacked Redline Stealer sample. There are often several ways to find unpacked binaries, particularly when using dynamic analysis. In this video, we'll take a look at the .NET-based downloader and unravel some of it's logic. We'll then use memory dumps from Triage to identify our unpacked payload and use PEBear to re-align the segments for analysis. By the end of this …

analysis dynamic dynamic analysis find memory redline redline stealer series stealer unpacking video