Malware Analysis Sus files(2)

[likeastar20]

@struppigel @Trident @SeriousHoax @Andrew3000 @Kongo

I helped some guy remove them, and I'm curious what they actually were. for the second file, the .exe got caught by his AV(which is BD), so I can't actually provide it(does not seem to be in quarantine either).

 

[likeastar20]

Download the zips from Triage as I cannot link the direct upload on the forum

89182337d39268acce8b9843af9c84ca00ba41a394e8ded1426f95d6d63964c3 | Triage

Check this report malware sample 89182337d39268acce8b9843af9c84ca00ba41a394e8ded1426f95d6d63964c3, with a score of 3 out of 10.

tria.ge

ec27626fe895f819d7e713e26452947e646e152964f43dfc629aec1b6406c70a | Triage

Check this report malware sample ec27626fe895f819d7e713e26452947e646e152964f43dfc629aec1b6406c70a, with a score of 3 out of 10.

tria.ge

 

[struppigel]

Sorry, but I need to register for download. And this happens when I try to register for tria.ge:



File is not on VT either. If you upload it there, I can access it.

 

[Kongo]

this will take a while...

 

[likeastar20]

Sorry, but I need to register for download. And this happens when I try to register for tria.ge:

View attachment 277018

File is not on VT either. If you upload it there, I can access it.

I can link the. exe directly from VT, but I don't think the. exe works without the other files in its folder.

Here is the .exe: VirusTotal

here is the zip if you can download it: VirusTotal



As I said, there is no .exe for the lisk file (deleted by BD). But after some digging, it seems it's related to this: "Lisk is an open source blockchain application platform designed to provide developers with a simpler path to blockchain production. It also provides users with a diverse and easy-to-use ecosystem with many applications to explore." I downloaded the installer from a GitHub page, VT report below.

VirusTotal

VirusTotal

www.virustotal.com

He mentioned that he had no idea what they were or where they came from.

 

[likeastar20]

@struppigel

AgeoStealer malware - static analysis

Ageo (or Space) stealer is info stealer malware distributed as electron based 64bit app and posed as a “free game”.but as we know there’s nothing for free, specially when it comes from an untrusted source or developer. today we’ll perform a static analysis trying to dissect this app.first step...

walidbarakat.github.io

Off topic, but I just happened to find the above analysis on reddit. Seems like your guide on extracting app.asar was useful?

 

[struppigel]

I can link the. exe directly from VT, but I don't think the. exe works without the other files in its folder.

Here is the .exe: VirusTotal

here is the zip if you can download it: VirusTotal



As I said, there is no .exe for the lisk file (deleted by BD). But after some digging, it seems it's related to this: "Lisk is an open source blockchain application platform designed to provide developers with a simpler path to blockchain production. It also provides users with a diverse and easy-to-use ecosystem with many applications to explore." I downloaded the installer from a GitHub page, VT report below.

VirusTotal

VirusTotal

www.virustotal.com

He mentioned that he had no idea what they were or where they came from.

The file that I cannot access is 89182337d39268acce8b9843af9c84ca00ba41a394e8ded1426f95d6d63964c3
But yeah, I can check the other sample.

 

[SeriousHoax]

I was able to download from Triage but it seems these are not the original exe file as you said BD had already detected and removed that on the system. But @struppigel should be able to investigate as it looks similar to the Electron based malware where the main culprit was hiding in the .asar file as he showed us in his analysis video.

 

[struppigel]

It looks similar to Electron because it is also a Node.js application. But not Electron. It is also correct that the full folder's contents are necessary to run everything. But one could create a standalone executable by creating an SFX with 7zip. If you think this helps you with automatic analysis sandboxes, I can try to create one.

You find the entry point of the application in the package.json. This file mentions first_page.html as main.

The malicious code is inside: init/first_page.html
In first_page.html you see obfuscated JavaScript.

The application creates a folder in %LOCALAPPDATA%\Leading and saves a lot of data there.
You should delete this folder on your friend's system.

Looks like adware/spyware to me. The folder is full of affiliate and advertising related data.

Didn't have time to deobfuscate the code yet, it looks a bit nasty, and I do not think it is worth sinking hours into it because it does not seem to be a serious threat. It stems likely from a Potentially Unwanted Software download. Make sure to check the installed programs on the system for PUP.

 

[likeastar20]

It looks similar to Electron because it is also a Node.js application. But not Electron. It is also correct that the full folder's contents are necessary to run everything. But one could create a standalone executable by creating an SFX with 7zip. If you think this helps you with automatic analysis sandboxes, I can try to create one.

You find the entry point of the application in the package.json. This file mentions first_page.html as main.

View attachment 277024

The malicious code is inside: init/first_page.html
In first_page.html you see obfuscated JavaScript.

View attachment 277023

The application creates a folder in %LOCALAPPDATA%\Leading and saves a lot of data there.
You should delete this folder on your friend's system.

View attachment 277021

View attachment 277025

Looks like adware/spyware to me. The folder is full of affiliate and advertising related data.

Didn't have time to deobfuscate the code yet, it looks a bit nasty, and I do not think it is worth sinking hours into it because it does not seem to be a serious threat. It stems likely from a Potentially Unwanted Software download. Make sure to check the installed programs on the system for PUP.

Thanks, this is what I wanted. Is there any relation with "Lisk" zip?(sent it in DM)

 

[struppigel]

Thanks, this is what I wanted. Is there any relation with "Lisk" zip?(sent it in DM)

The Lisk sample is an Electron application. So you can unpack the app.asar file as shown in the video. The executable seems to be missing, though. It is different JS code than Leading.

Edit: I somehow got to register on Tria.ge now. I uploaded the SFX for leading.exe

85ab31c1d2cf82b72a279ad7ba5b24dac3eadcd91af9ee9e677dbe188cd9f801 | Triage

Check this report malware sample 85ab31c1d2cf82b72a279ad7ba5b24dac3eadcd91af9ee9e677dbe188cd9f801, with a score of 7 out of 10.

tria.ge