Malware: Suspicious Time Tracker with keylogger
Analyzing keylogger malware hidden inside daily time tracker app dailytimetracker.exe. Hello World. Today, while hunting for new suspicious electron based applications I ran across daily time tracker. While hunting, I noticed these trackers appear to talk to app.dailytimetrack[.]com. The applications in question also appear to drop a lot of python files. Take this file for example: dailytimetracker.exe . Well, that's interesting. So, I decided, why not got to dailytimetrack[.]com and download this application and start looking at it. Wouldn't you know it though, to my surprise, the version I got from there wasn't a python based malware, but rather, JS based malware wrapped inside an electron application! The downloaded installer is NSIS installer, which can be extracted easily enough with 7Zip. This has an app-64.7z file which then unpacks all the electron based app data. At a glance, there isn't to much super intersting about the main.js/preload.js files. Some o...