TamperedChef: Suspicious Recipe App is really Malware
Hello World! Let me introduce you to a new malware I'm calling TamperedChef . Yesterday I came across the article Malvertising Alert: Recipe App Hijacks Credentials and Appears to Establish C&C Connection . This got me curious, so I decided to dig a bit deeper. I manually went to recipelister ( VirusTotal ) and downloaded recipelister.exe. After reading the aforementioned blog, which observed the 7z-out folder, I figured why not use 7zip to extract recipelister.exe. Within the compressed file was app-64.7z, which I again extracted I extracted using 7zip. At this point we have the main contents of what would appear in "AppData\Local\Temp\2w1rXpxZnwDUwuTeNvdD6FUkeI0". Extracting app.asar: In order to extract app.asar to be easier to look at, I used this 7z asar plugin . This is where things get interesting. When we start looking at main.js, all the while running Fiddler, we observe a lot of suspicious code and activity. The main.j...