I want to manually unpack red Petya ransomware. I used Ollydbg for unpacking and set breakpoint on VirtualAlloc to see the "MZ" header in memory dump, and saved it to a file. But the saved file is not valid, PEiD say it is not a valid file for example. I think it destroys its data directories. Is there any solution for repair this executable that I can try?
-
5wouldnt it be nice if you provided the samples and the unpacking steps you used to get to whatever it is you got..– SigtranCommented Aug 3, 2017 at 9:09
-
@Sigtran i followed this : paulslaboratory.blogspot.nl/2014/04/…– ArianCommented Aug 3, 2017 at 13:00
-
I dont think this blog describes the unpacking of petya. looking at the VT detections this is Fareit/zbot.. from 2013. is this the same sample you are trying to unpack?– SigtranCommented Aug 3, 2017 at 15:15
-
@Sigtran No i want to unpack red petya, but Petya also uses virtual alloc.– ArianCommented Aug 4, 2017 at 6:28
-
1well. if you say so.. it would be easier to answer your question if you.. - provided the sample. - provided the steps to reproduce your issue.– SigtranCommented Aug 4, 2017 at 9:41
Add a comment
|
2 Answers
hasherezade from malwarebytes did an excellent analysis for Red Petya (version 1) including a step-by-step process on how to unpack it.
However, if we try to dump it, we don’t get a valid executable. Its data directories are destroyed. The PE file have been processed by the cryptor in order to be loaded in a continuous space, not divided by sections. It lost the ability to run independently, without being loaded by the cryptor’s stub. Addresses saved as RVA are in reality raw addresses. I have remapped them using a custom tool, and it revealed more information, i.e. the name of this PE file is Setup.dll:
Generally, solution is to properly understand what the malware does instead of just breakpointing VirtualAlloc and waiting for a functioning PE to be handed to you on a silver platter.
This usually entails debugging the malware before PE file is being loaded and and after the VirtualAlloc call is made, and taking not on everything done on the file. It might be beneficial to use a more interactive debugger for that phase, such as IDA or radare2, so tracking manipulation of the file will be easier.
