DESCRIPTION
In this Twitch stream we take a look at the new Latrodectus variant which uses AES to encrypt its strings. Instead of writing an AES string decrypter we take a generic "black box approach" using emulation to simply emulate the full decryption algorithm.
Samples
5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8
Notes (with code)
Latrodectus - Extracting new AES encrypted strings from this RAT