Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add initial MileRAT hashing algo #48

Closed
wants to merge 2 commits into from

Conversation

Still34
Copy link
Contributor

@Still34 Still34 commented Nov 17, 2023

No description provided.

@Still34
Copy link
Contributor Author

Still34 commented Nov 17, 2023

Not entirely sure what's causing the failure here - help appreciated

@herrcore
Copy link
Member

Not entirely sure what's causing the failure here - help appreciated

This algorithm already exists

TEST_1 = 150583839

You can hunt for hashes using the hunt endpoint https://hashdb.openanalysis.net/#tag/hunt if the hashes used by this algo do not show up please log a bug.

For future reference there is a test that will automatically check for hash algorithm collisions that you can run locally (step 6)

https://github.com/OALabs/hashdb#how-to-add-new-hashes

@herrcore herrcore closed this Nov 17, 2023
@Still34
Copy link
Contributor Author

Still34 commented Nov 17, 2023

Huh, yeah, the main reason why I created this PR in the first place is that it did not show up on the hunted results. Strange.

@Still34
Copy link
Contributor Author

Still34 commented Nov 17, 2023

For reference, GetProcAddress == 0x1AB9B854 in the actual code.

@Still34
Copy link
Contributor Author

Still34 commented Nov 17, 2023

Yeah, I could not get any hits with existing algos - might be caused by the extra & 0x7FFFFFFF?
image
image

Edit: Some of the hashes would hit the aforementioned MUL 0x83, but some won't.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants