Learning Malware Analysis

4.2 Automated Unpacking

There are various tools that allow you to unpack the malware packed with common packers such as UPX, FSG, and AsPack. Automated tools are great for known packers and can save time, but remember, it may not always work; that is when the manual unpacking skills will help. TitanMist by ReversingLabs (https://www.reversinglabs.com/open-source/titanmist.html) is a great tool that consists of various packer signatures and unpacking scripts. After you download and extract it, you can run it against the packed binary using the command shown here; using -i, you specify the input file (packed file), and -o specifies the output filename, and -t specifies the type of unpacker. In the later-mentioned command, TitanMist was run ...