Live Stream VOD: Indirect Syscalls and The PikaBot Loader (Patreon)

In this stream we take a look at the new PikaBot loader which uses indirect syscalls to evade AV/EDR. As part of the analysis we develop a quick way to trace indirect syscalls with x64dbg and use this method to unpack the final payload.

Syscall work starts around the 40min mark 😉

Sample

fd8c7df2940c86b821c05d9376f7dc3716306f8e0a933e2e161da09989907ca3 [UnpacMe]