{ Security-in-bits }

#pe-sieve

1 post

Unpack RedLine stealer to extract config using pe-sieve -Part 2
Feb 6, 2024
Unpack RedLine stealer to extract config using pe-sieve. pe-sieve dumps then unpacked files from memory. Then, extract the config from the dumped file.

Get the next detection in your inbox

One lab-proven detection per issue: the attacker command, the telemetry it leaves, and the KQL / ES|QL that catches it.

You confirm on Substack in one tap.

No spam. Unsubscribe anytime.