@bartblaze @joshcannell Thats runPE not citadel.instead, locate third param to first WPM call with size 0x400 (PEheader) &save it to a file.
How to Unpack a Self-Injecting Citadel Trojan http://wp.me/p2plUD-TC via @joshcannell
-
-
-
@r41p41@bartblaze runPE is the technique used, Citadel is the unpacked binary. - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.