Memory Dump Unpacking - Finding Redline Stealer

[@DEF3NDME]

I liked the idea of pivotting between IOCs from Threat intellegnce reports to get what you missed from that unreashable endpoint.

[@jstrosch]

Thanks!

[@rajnepali1660]

This is awesome. Thanks for sharing Josh

[@jstrosch]

Glad to hear - you're very welcome!

[@TheRaghav12345678910]

Thanks!

[@jstrosch]

Welcome!

[@rizwanmehboob4725]

Great content, thanks for sharing Josh. I just wanted to know how you determined the raw size when making the raw address same as virtual address ?

[@jstrosch]

Hi! I just used the virtual size - assuming that size should match up since we are working with the process image. I haven't used this technique extensively so there could be plenty of issues, but for the most part it seems to work well :) Let me know if this helps.

[@MonstrMash123458943]

This is so cool i was wondering could you make a video on rebuilding a virtual function table with ghidra

[@jstrosch]

I’ve added it to my list of topics :) Thanks for the suggestion.

[@duckie4670]

great content :D

[@jstrosch]

Thank you :)