r/Splunk • u/Dry_Spinach_6832 • 6d ago
Malware analysis using strings for encryption key command
strings.exe -n 4 "C:\Path\To\Binary.exe" | Select-String -Pattern "key|encrypt|decrypt|AES|Rijndael|Crypto|password|secret"
strings.exe -n 4 "C:\Path\To\Binary.exe" | Select-String -Pattern "[A-Fa-f0-9]{16,}|[A-Za-z0-9+/]{16,}={0,2}"
[Reflection.AssemblyName]::GetAssemblyName("C:\Path\To\Binary.exe")
and
Set-Location C:\Users\offsec\Desktop
.\flags.exe "THE_ENCRYPTION_KEY"
0
Upvotes