AuRAT-Deobfuscator

KO | EN

gitlite — search

#javascript #python #ai #typescript #llm #go #golang #deep-learning #windows #vue #awesome-list #pytorch #mcp #open-source

AuRAT-Deobfuscator

(★ 12)

Static Deobfuscator for AuRAT Malware Family

AuRAT-Deobfuscator 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h1 align="center">Static Deobfuscator - AuRAT</h1>

After analyzing **AuRAT** I discoverd that contains **Dynamic API Resolution Obfuscation**  where each library has its own dedicated resolver thats resolve function by its own hash
- `kernel32` -> `0x180001000`
- `user32`  -> `0x180001160`
- `msvcrt`  -> `0x1800012D0`
- `advapi32`  -> `0x180001430`
- `Wtsapi32`  -> `0x180001590`
- `ws2_32`    -> `0x180001850`

there are also some special resolvers that returns specific function

- `HeapAlloc` -> `0x1800010B0`
- `wsprintfA`  -> `0x180001160`
- `IsUserAnAdmin`  -> `0x1800016F0`
- `GetUserProfileDirectoryA`  -> `0x1800019B0`

Based on this analysis i developed this **Static Deobfuscator** based on **Pattern Matching** to identify the the obfuscated API calls and deobfuscate this and make it direct call to the API

> [!Note]
> **This deobfuscator can work with any sample from this malware family you just need to update the resolvers addresses.**

# Before

# After

# Installation

```
git clone https://github.com/0xilovebits/AuRAT-Deobfuscator
cd AuRAT-Deobfuscator
pip install -r requirements.txt
```

AuRAT-Deobfuscator

AuRAT-Deobfuscator 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

AuRAT-Deobfuscator

AuRAT-Deobfuscator 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README