Dumping Embedded Java Classes
ID: 9913aeb3-46a6-5f6d-ad45-d4ec12c95e0f
STIX ID: report--9913aeb3-46a6-5f6d-ad45-d4ec12c95e0f
Feed Name: TrustedSec blog
Threat Score
This report details a method for extracting in-memory Java classes from obfuscated Java malware using Oracle JVM tooling: an Attacher program that calls VirtualMachine.attach and loadAgent, and an Agent implementing ClassFileTransformer to write loaded classes to .class files for subsequent decompilation and analysis. It covers the Agent manifest entries, agentmain/premain methods, implementation notes, and build/run commands to dump and recover hidden classes.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.