Malware | ConsulThink

Rustware Part 3: Dynamic API resolution

Consulthink — Fri, 09 Feb 2024 10:55:00 +0000

In the previous blog post we have seen how to perform a shellcode process injection by finding a target process PID using several WinAPIs, in that case all the WinAPIs were called directly. Usually malwares resolve the WinAPI address at runtime in order to hide malicious behaviours during static analysis. In this blog post we ...

The post Rustware Part 3: Dynamic API resolution first appeared on ConsulThink.

Rustware Part 2: Process Enumeration Development

Consulthink — Mon, 06 Nov 2023 12:18:11 +0000

In the previous blog post we have seen how to develop a Shellcode Process Injection in Rust; the described Process Injection flow relies on several WinAPIs: OpenProcess used to open a handle to the target process, then the VirtualAllocEx was used to allocate a new readable and writable region of memory into the target process, ...

The post Rustware Part 2: Process Enumeration Development first appeared on ConsulThink.