SCATTERBRAIN: UNMASKING THE SHADOW OF POISONPLUG'S OBFUSCATOR

Summary from the TLDR InfoSec newsletter

Since 2022, Google Threat Intelligence Group (GTIG) has been tracking a group of malware samples that use the PoisonPlug moniker and employ a complex obfuscator. The ScatterBrain obfuscator operates in three different protection modes which determine to what extent it obfuscates the control flow graph, mutates instructions, and protects the binary's import table. The post walks through how GTIG reverse engineered this obfuscator and created a deobfuscator tool.