Post #2171869

A .WAV With A Payload There have been reports of threat actors using a [.wav file as a vector for malware](https://www.bleepingcomputer.com/news/security/backdoored-telnyx-pypi-package-pushes-malware-hidden-in-wav-audio/). It's a proper .wav file, but they didn't use staganography. The .wav file will play, but you'll just hear noise. That's because the TAs have just replaced the bytes that encode the sound with the BASE64 representation of their payload. Thus I don't need a .wav parser to extract the encoded payload, I can just use my [base64dump.py](https://github.com/DidierStevens/DidierStevensSuite/blob/master/base64dump.py) tool. The BASE64-decoded payload is an XOR-encoded PE file. So I don't need to make a custom decoder, I can just perform a known-plaintext attack looking for the DOS header with my xor-kpa.py tool: The XOR key was found. Thus we can easily dump the decoded PE file and see the MZ header at position 0x08 and a bit further down the DOS header we used in the known-plaintext-attack: And my tool pecheck.py can extract an analyse the sample: https://isc.sans.edu/diary/A+WAV+With+A+Payload/32910/ #malware #wav