Security Magic

TL;DR “SystemShock is a malicious DLL loaded by Electron Apps masquerading as production tools. The DLL performs anti-analysis and anti-vm checks and then attempts to download or run additional code. The file also sends data that is likely stealing information and sending screenshots. More about the specifics of the Electron Apps found can be read on Malware Analysis: Fake Google Meet Application .” Background:  Earlier in the week I ran across some fake video conferencing applications, these gave the user the impression that they were installers for tools such as MS Teams, Google Meet, and Zoom. However, none of these were signed by their respective organizations.  A review of the applications showed a complex and layered approach to hide a DLL that performs anti-analysis and anti-VM checks. The DLL also acts as a downloader for additional malware, AMSI bypass tools, and even appears to send out some recon data in the fo...

Malware Analysis of a fake Google Meet Application that drops SystemShock Loader. TL;DR “Fake Google Meet installer unpacks an Electron app that performs anti-analysis checks and downloads follow-on stealer/downloader payloads (not signed by Google). Check out more information on SystemShock Loader .”  While hunting suspicious Electron applications in VirusTotal, I came across  Google_Meet 1.2.1.exe , which isn't signed by Google. The application is instead signed by " Gucheng County Sili Technology Co., Ltd .", a now revoked certificate signer.  However, VirusTotal has, at the time of this writing, 0 detections for this. So how bad can it be? This is an NSIS installer executable, meaning I can extract the files with 7Zip. Inside the $PLUGINSDIR, is an app-64.7z file, in recent EvilAI and TamperedChef campaigns this usually means this is an Electron based application that is extracted. Quick Note on EvilAI...