Tips & Trick
216

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware






  14-Sep-2022 12:01:07




FLARE Obfuscated String Solver

Rather than heavily protecting backdoors with hardcore packers, many malware authors evade heuristic detections by obfuscating only key portions of an executable. Often, these portions are strings and resources used to configure domains, files, and other artifacts of an infection. These key features will not show up as plaintext in output of the strings.exe utility that we commonly use during basic static analysis.

The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses advanced static analysis techniques to automatically deobfuscate strings from malware binaries. You can use it just like strings.exe to enhance basic static analysis of unknown binaries.

FLOSS extracts all the following string types:

  1. static strings: "regular" ASCII and UTF-16LE strings
  2. stack strings: strings constructed on the stack at run-time
  3. tight strings: special form of stack strings, decoded on the stack
  4. decoded strings: strings decoded in a function

Please review the theory behind FLOSS here.

Our blog post talks more about the motivation behind FLOSS and details how the tool works.

FLOSS version 2.0 updates are detailed in this blog post.

Quick Run

To try FLOSS right away, download a standalone executable file from the releases page: https://github.com/mandiant/flare-floss/releases

For a detailed description of installing FLOSS, review the documentation here.

Usage

Extract obfuscated strings from a malware binary:

$ floss /path/to/malware/binary

Display the help/usage screen to see all available switches.

$ floss -h

For a detailed description of using FLOSS, review the documentation here.

For a detailed description of testing FLOSS, review the documentation here.


Doc : https://github.com/mandiant/flare-floss/blob/master/doc/installation.md 


Github : https://github.com/mandiant/flare-floss 

*Beware click the link!


DISCUSSION

Nice post bro




Reply

Login for report, comment and join discussion
Login Here
Sponsored

Popular Posts
Gps Tracker Seccodeid Free Too...
General
21165
202
Top


Djie sam soe Djie sam soe
Complete Basic Course in Kali...
Linux
14157
4
Top


Djie sam soe Djie sam soe
Komintod (Ministry of Communic...
Data Leak
6396
70
Top


Murtad methamphetamine Murtad methamphetamine
Free Proxy List
Networking
3596
3
Top


Sandidi Sandidi
Mass Reverse IP Unlimited
Tools Hacking
3314
13
Top


ImamWawe ImamWawe

Related Post

Youtube Video

Subscribe