diff --git a/_posts/2024-02-25-AGENT-TESLA-1.md b/_posts/2024-02-25-AGENT-TESLA-1.md index 5463ec9..43f6795 100644 --- a/_posts/2024-02-25-AGENT-TESLA-1.md +++ b/_posts/2024-02-25-AGENT-TESLA-1.md @@ -275,7 +275,7 @@ Opening the dumped file in dnSpy confirms that it is indeed Agent Tesla ![alt text](/images/at1/image-56.png) _Figure 53_ -Stay tuned for part two where we will be removing Agent Tesla's control flow flattening by writing our own de4dot plugin! +I recommend [checking out my next post](https://ryan-weil.github.io/posts/AGENT-TESLA-2/) where I demonstrate how to remove Agent Tesla's control flow flattening by writing a de4dot plugin! ## IOC MD5's diff --git a/_posts/2024-02-28-AGENT-TESLA-2.md b/_posts/2024-02-28-AGENT-TESLA-2.md index 07d0908..3acad0d 100644 --- a/_posts/2024-02-28-AGENT-TESLA-2.md +++ b/_posts/2024-02-28-AGENT-TESLA-2.md @@ -7,7 +7,7 @@ categories: malware ## Introduction -In the [previous post](https://ryan-weil.github.io/posts/AGENT-TESLA-1/), we successfully unpacked Agent Tesla. We left off on a bit of a cliffhanger though, because after opening it in dnSpy it was apparent that it had control flow flattening applied. At first glance it doesn't look too unreadable: +In the [previous post](https://ryan-weil.github.io/posts/AGENT-TESLA-1/) we successfully unpacked Agent Tesla. We left off on a bit of a cliffhanger though, because after opening it in dnSpy it was apparent that it had control flow flattening applied. At first glance it doesn't look too unreadable: ![alt text](/images/at2/first.png) _Figure 1_ diff --git a/assets/lib b/assets/lib index 7bc0d86..b9c58cf 160000 --- a/assets/lib +++ b/assets/lib @@ -1 +1 @@ -Subproject commit 7bc0d86b6af83d7acfc63db50f29a5975cec2513 +Subproject commit b9c58cf485a7dcbc833e698d67dd1850bdc93eb3