---
id: 7441
title: "Làm thế nào để tìm các URL trong các biến thể của Win32-Sality"
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/lam-the-nao-de-tim-cac-url-trong-cac-bien-the-cua-win32-sality/"
published_at: "2017-10-30T09:44:00Z"
tags: ["reverse-engineering", "malware-analysis", "capstone", "emulation", "win32-sality", "file-infector", "unicorn"]
phying_url: "https://phying.com/item/7441"
lang: en
---

# Làm thế nào để tìm các URL trong các biến thể của Win32-Sality

## Summary

An emulator-based approach built on Capstone, Unicorn and Keystone to automatically extract short-lived C2 URLs from Win32.Sality file-infector variants without sandbox detonation or manual tracing.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **Published:** 2017-10-30T09:44:00Z
- **Original:** https://blog.viettelcybersecurity.com/lam-the-nao-de-tim-cac-url-trong-cac-bien-the-cua-win32-sality/
- **Phying News:** https://phying.com/item/7441