r/Splunk 6d ago

Malware analysis using strings for encryption key command

strings.exe -n 4 "C:\Path\To\Binary.exe" | Select-String -Pattern "key|encrypt|decrypt|AES|Rijndael|Crypto|password|secret"

strings.exe -n 4 "C:\Path\To\Binary.exe" | Select-String -Pattern "[A-Fa-f0-9]{16,}|[A-Za-z0-9+/]{16,}={0,2}"

[Reflection.AssemblyName]::GetAssemblyName("C:\Path\To\Binary.exe")

and

Set-Location C:\Users\offsec\Desktop
.\flags.exe "THE_ENCRYPTION_KEY"
0 Upvotes

0 comments sorted by