myrtus0x0/smoke_conf_extractStatic config extractor for SmokeLoader samples that deobfuscates, unpacks, and emulates protected routines to recover final-stage C2 settings.
This project aims to extrct configurations from smokeloader samples starting at the initial stage. I was set on doing this statically so had to rely on things like Unicorn to bypass some of the more complicated components.
Regardless of how this extraction works for this family, this repository can serve as an example for how config extraction might wokr for non traditional malware families
virtualenv venv
source venv/bin/activate
pip install -r requirements.txt
python main.py smokeloader_stage_1.bin --json