https://connar.github.io/tags/dll-hijacking/Recent content in Dll-Hijacking on Journal of ConnarHugo -- 0.147.3en-ushttps://connar.github.io/posts/dll-hijacking-journey/Mon, 01 Jan 0001 00:00:00 +0000https://connar.github.io/posts/dll-hijacking-journey/<h1 id="a-journey-into-dll-hijacking---hunting-my-own-signed-binary">A journey into DLL Hijacking - Hunting my own signed binary</h1> <h2 id="1-where-this-started">1. Where this started</h2> <p>There was a point in the past where me and my friend <code>@r4sti</code> wanted to dig into inno installers and how they could be abused in malware campaigns (<em>perhaps a future post about it</em>). Unfortunately, he had to go afk for a while, and thus I started researching on the topic. This is when I came across a <a href="https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html">Splunk threat research writeup</a> on a RedLine Stealer campaign delivered through a trojanized Inno Setup installer, and I started reading it to learn how the installer itself was being weaponized.</p>