eset/wslink-vm-analyzerWslinkVMAnalyzer is a tool to facilitate analysis of code protected by a virtual machine featured in Wslink malware
WslinkVMAnalyzer is a tool primarily developed to facilitate analysis of Wslink, which is a unique loader running as a server and executing received modules in-memory. This tool uses Miasm, an open source framework that provides us with a symbolic execution engine.
The tool and structure of the virtual machine is described in our blogpost.
% pip3 install https://github.com/eset/wslink-vm-analyzer/archive/refs/heads/master.tar.gz
In the examples directory, you will find a dump of the virtual machine and
two Python scripts. The scripts output Graphviz DOT files (vma.dot) which
can by converted to SVG or any other format supported by Graphviz.
(./examples) % python3 VM1.py
(./examples) % dot -Tsvg vma.dot -o vma.svg