1.2 KiB
1.2 KiB
Malware Config And Staging Checklist
Hunt For The Config Boundary
- Resources, overlays, embedded archives, section anomalies, decode helpers, registry seeds, bootstrap responses, stage2 memory
- Nearby markers: URLs, mutex seeds, wallet-like strings, campaign IDs, bot IDs, task routes, persistence names
Reconstruct The Transform Chain
Track in order:
- Container or embedded layer
- Compression or chunking
- Encoding or substitution
- XOR or custom masks
- Crypto
- Final parse into fields
Tie Fields To Behavior
- Beacon path or host -> network flow
- Mutex or install path -> persistence branch
- Campaign or bot id -> server-side routing or tasking
- Wallet or key material -> downstream protocol or decryption branch
Evidence To Keep
- One compact block for offsets, hashes, decode helpers, keys, masks
- One compact block for parsed fields and what branch each field affects
- Original, unpacked, dumped, and parsed outputs kept as separate artifacts
Common Pitfalls
- Treating one IOC-looking string as the config without proving the full chain
- Mixing fields from separate decode paths as if they came from one blob
- Forgetting to prove where config becomes plaintext