Post #3442654

This malware is pretty cool, it took me a while to get to the 4th obfuscation layer myself in IDA even when using a deobfuscation plugin myself, mixes its own obfuscated code deep in legitimate "goodware" code, uses lots of MBAs, has anti-VM tricks. High quality malware. https://www.elastic.co/security-labs/oxloader-malware-loader-infostealer #malware #ida #reversing #reverseengineering