Emotet

Deobfuscate PowerShell using PowerShell Logging

April 20, 2019

Deobfuscation, Emotet, PowerShell, Qakbot

We will use inbuilt PowerShell Logging in Windows 10 VM to deobfuscate PowerShell code used to deliver Emotet & Qakbot. Malware uses PowerShell mostly to download payload from CC and execute it. Why do we need to do this? Easy technique to deobfuscate PowerShell without using any external tool Extract…

Deobfuscate Emotet PowerShell – Part 0x2

May 26, 2018

Deobfuscation, Downloader, Emotet, PowerShell, Video Tutorial

We will deobfuscate PowerShell and extract CC from the PowerShell cmd extracted from the Emotet downloader macro discussed in the previous article. If you want to learn how to deobfuscate and analyse the malicious macro code, please check this article and video. Video Tutorial Let see how to use this above…

Deobfuscate malicious macro – Part 0x1

May 20, 2018

Deobfuscation, Doc, Downloader, Emotet, Macro analysis, Video Tutorial

We will concentrate on malicious macro embedded in Emotet downloader office documents and see how to deobfuscate the macro code. In the next post we will deobfuscate the PowerShell executed by Word Doc. Why do we need to do this? Malicious code embedded in macro instead of exploit Clean up…