https://github.com/eset/stadeo

Control-flow-flattening and string deobfuscator
https://github.com/eset/stadeo

control-flow deobfuscation deobfuscator emotet ida ida-pro idapython malware miasm python reverse-engineering stantinko strings

Last synced: 3 months ago
JSON representation

Control-flow-flattening and string deobfuscator

• Host: GitHub
• URL: https://github.com/eset/stadeo
• Owner: eset
• License: other
• Created: 2020-07-14T17:49:44.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2021-11-08T11:33:30.000Z (about 3 years ago)
• Last Synced: 2024-04-09T10:33:36.249Z (10 months ago)
• Topics: control-flow, deobfuscation, deobfuscator, emotet, ida, ida-pro, idapython, malware, miasm, python, reverse-engineering, stantinko, strings
• Language: Python
• Homepage:
• Size: 1.91 MB
• Stars: 137
• Watchers: 6
• Forks: 15
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
Stadeo

======

Stadeo is a set of tools primarily developed to facilitate analysis of

[Stantinko](https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/),

which is a botnet performing click fraud, ad injection, social network

fraud, password stealing attacks and

[cryptomining](https://www.welivesecurity.com/2019/11/26/stantinko-botnet-adds-cryptomining-criminal-activities/).

The scripts, written entirely in Python, deal with Stantinko's unique

control-flow-flattening (CFF) and string obfuscation techniques

described in our March 2020

[blogpost](https://www.welivesecurity.com/2020/03/19/stantinko-new-cryptominer-unique-obfuscation-techniques/).

Additionally, they can be utilized for other purposes: for example,

we’ve already extended our approach to support deobfuscating the CFF

featured in Emotet – a trojan that steals banking credentials and that

downloads additional payloads such as ransomware.

Our deobfuscation methods use

[IDA](https://www.hex-rays.com/products/ida/), which is a standard tool

in the industry, and [Miasm](https://github.com/cea-sec/miasm) – an open

source framework providing us with various data-flow analyses, a

symbolic execution engine, a dynamic symbolic execution engine and the

means to reassemble modified functions.