ch0ic3/CyberThreatIntel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Analysis.md

Browse Source
This commit is contained in:
StrangerealIntel 2020-01-02 21:42:00 +01:00 committed by GitHub
parent fc80400dae
commit 5ad7c187a6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Additional Analysis/Terraloader/02-01-20/Analysis.md
View File

@ -570,7 +570,7 @@ function decode_payload(arg, offset1, offset2)
} }
``` ```
<h6>Now, the main algorithm for the main function</h6> <h6>Now, the main algorithm for the main function. Firstly, this used use a do-while loop to generate a sequence of elements if this trigger the same sequence that the reference, this break the loop in changing the value.</h6>
```javascript ```javascript
function main() function main()
@ -638,6 +638,19 @@ function main()
base_rc4_array = 0; base_rc4_array = 0;
i = 0; i = 0;
offset_tab = lim + index; offset_tab = lim + index;
```
<h6>By debug, this give the following parameters : </h6>
|Variable|Value|
| ------------- |:-------------:|
|i|200|
|lim|3|
|index|18|
|offset|21|
|tab|[98,72,102,109,106,112,83,117,101,117,65,79,115,68,88,116,104,108,49,57,57]|
```javascript
if (iden_correct === 915) if (iden_correct === 915)
{ {
blawp4015 = 'EeIv%zg?"inD5mU'; blawp4015 = 'EeIv%zg?"inD5mU';