Malware Analysis Capcut fake stealer

[likeastar20]

There is a new stealer that masquerades as an app called Capcut. As of time of writing, the only detection on VT is from Kaspersky. I tested the sample with BD, no reaction. (@silversurfer @SeriousHoax @RansomwareRemediation).

VirusTotal

VirusTotal

www.virustotal.com

Triage | 9832647d56bce277c025944ca38095da9942add7aa235893785a3d8e86eaa4ed

Check this malware sample report @ 9832647d56bce277c025944ca38095da9942add7aa235893785a3d8e86eaa4ed, with a score of 0 out of 10.

tria.ge

Not detected by Avast.

 

[Shadowra]

Kaspersky : UDS:Trojan-PSW.Win64.Fobo.jk

Harmony : detected (PDM:Trojan.Win32.Generic)

DeepInstinct : not detected :/

 

[likeastar20]

Kaspersky : UDS:Trojan-PSW.Win64.Fobo.jk

Harmony : detected (PDM:Trojan.Win32.Generic)

DeepInstinct : not detected :/

I wonder if Harmony will detect it with the Sophos Engine?

 

[Shadowra]

I wonder if Harmony will detect it with the Sophos Engine?

@Trident has it with Sophos, I hope he can test it

 

[Trident]

@Trident has it with Sophos, I hope he can test it

Yeah, when I finish at the gym I will test it.

 

[likeastar20]

This is the source of the sample btw

 

[SeriousHoax]

Detected by MD after extraction.

No wait, MD only detects the gz file inside the triage archive. gz is also an archive format. No detection on the exe file itself. Haven't executed yet.

 

[likeastar20]

For those who do not know, you can see a full report of VirusTotal VM called Zenbox. Works for (almost) any sample.



Here are just the Indicators:

 

[silversurfer]

Just tried as quick test only in VMware Pro v.17 (Win 10 x64), this sample does still run with outbound connection, no reaction from BD Free at least so far...

 

[likeastar20]

Just tried as quick test only in VMware Pro v.17 (Win 10 x64), this sample does still run with outbound connection, no reaction from BD Free at least so far...

View attachment 277089

I have not yet sent the sample directly to any AV vendor. I wanted to see who would detect it first with their behavior modules. If I send it to BD for example, I expect the sample to be detected in about 2-3H...

 

[SeriousHoax]

Blacklisted by ESET cloud.

 

[Trident]

Harmony Endpoint with Sophos, the file is detected by threat emulation upon download.
I switched emulation off and executed the file, there is no detection.
There is also no node.js or anything suspicious running.

Edit:
The file relies on openconsole.exe which under my policy is blocked. The sample can't work properly.

 

[HarborFront]

Have to wait a while before detection by other AV/AM at VirusTotal especially for a new malware

 

[cruelsister]

K and Sophos will now detect both the original file and the triple sized thrown off daughter (actually even Defender is now aware). The spawned Visual Studio modules is also never a good thing. But once again an Outbound alerting Firewall would have noticed a connection out to Command, an Amazon addy also used in Olden Times by Darkside.

 

[HarborFront]

Quite a number of AV/AM are detecting it now at VirusTotal

 

[upnorth]

There is a new stealer that masquerades as an app called Capcut.

Was reported about 2 months ago here:

Cloned CapCut websites push information stealing malware

A new malware distribution campaign is underway impersonating the CapCut video editing tool to push various malware strains to unsuspecting victims. CapCut is ByteDance's official video editor and maker for TikTok, supporting music mixing, color filters, animation, slow-mo effects...

malwaretips.com

Even back in 2020 the Indian government wasn't happy about the official app.

India Government bans more Chinese apps (updated)

According to an early report from News18, the Government of India released an order on Friday that banned 47 more apps with Chinese connections. These apps are said to be functional clones of the apps that were banned earlier. The list of the newly banned app includes TikTok Lite, Helo Lite...

malwaretips.com

 

[likeastar20]

@Shadowra is it detected now by deepinstinct?

 

[silversurfer]

Just tried as quick test only in VMware Pro v.17 (Win 10 x64), this sample does still run with outbound connection, no reaction from BD Free at least so far...

View attachment 277089 View attachment 277090

Re-test this sample, this time BD Free does detect a part... but the source sample remained undetected for now

 

[SeriousHoax]

Re-test this sample, this time BD Free does detect a part... but the source sample remained undetected for now

View attachment 277103

I submitted this one to BD today in the morning before this stealer sample was shared here. Didn't notice that it was used in this one also. I saw a different malware using it yesterday. I asked BD to add atleast a PUP detection for it kind of similar to Kaspersky and they did it. Though Kaspersky's signature is "not-a-virus....." for this one which means Kaspersky on default settings would not notify (only if you open the K UI) or even stop execution of it. I don't know the details but the file can be used for legal purpose also.

 

[Shadowra]

@Shadowra is it detected now by deepinstinct?

Yep