Security Magic

All Posts Index A crawl-friendly, filterable index of every article on this site. Use the search to jump to any topic quickly. Filter by label… EvilAI Hydra7 / Hydraseven TamperedChef SolarMarker Loading post index…

Several Windows applications that present themselves as legitimate utilities—Internet speed testers, “manual reader” and “finder” tools, certain PDF utilities, and even some AI search frontends such as   justaskjacky   have been observed to drop a portable Node runtime folder alongside a heavily obfuscated JavaScript payload. The visible executable performs as expected to the users, however the installer also extracts the Node runtime, a scheduled task, and  an obfuscated *.js file that don’t appear necessary for the application's primary function. That JavaScript is executed by the dropped Node instance via a scheduled task (observed to run on roughly a 12-hour cycle). Its capabilities include encoded/obfuscated network communications and the potential to execute arbitrary code delivered by the server. Because the JS runs independently from the main executable and is persistent via scheduled tasks, it significantly increases the attack surface...

This is just a page of rough notes I'm taking as I go through Opulous analysis from https://x.com/sta5i/status/1962591346407154110 POST https://glitch.footballismy[.]life/api/4/envelope/ HTTP/1.1 x-sentry-auth: Sentry sentry_key=71878a140ea8482c86abc998e4ca02bb, sentry_version=7, sentry_timestamp=1757078735.0221975, sentry_client=sentry.rust/0.42.0 accept: */* host: glitch.footballismy[.]life content-length: 13132 sdk":{"name":"sentry.rust","version":"0.42.0","integrations":["attach-stacktrace","debug-images","contexts","panic","process-stacktrace"],"packages":[{"name":"cargo:sentry","version":"0.42.0"}]}} " POST http://ipc.localhost/loadData HTTP/1.1 Host: ipc.localhost Proxy-Connection: keep-alive Content-Length: 2 sec-ch-ua-platform: "Windows" sec-ch-ua: "Chromium";v="139...

 Looking at sample: da3c6ec20a006ec4b289a90488f824f0f72098a2f5c2d3f37d7a2d4a83b344a0 AppSuites-PDF-1.0.28 Specifically looking at the malicious JS file loaded. pdfeditor.js (b3ef2e11c855f4812e64230632f125db5e7da1df3e9e34fdb2f088ebe5e16603). Once this is deobfuscated using  https://obf-io.deobfuscate.io/  I can launch this using node.exe --inspect-brk, then launch edge://inspect to step through the JS. This write-up is a work-in-progress of findings as I go. Here are some of the interesting screenshots so far:  _0x279589 is populated by iterating through and decoding the variables below it. After running through these, here is a list of strings extracted for this sample: A4FDDP7: "ew-key" A6C2XCU: "id" A6C7C7N: "add" A43AUWU: "0.0.0.0" A64CEBI: "usid" A6882RQ: "Url" B4CB2TX: "split" B5D13XX: "https://sdk.appsuites.ai" B5D95P7: "Item2" B5E9U50: "api/s3/event" B40DLY6: "process" ...

UPDATE: September 18, 2025  Another variant of what I've been looking at over the past week caught my eye today. Just wanted to give a real quick review of this, showing the POST encoding/decoding process. OpenMyManual.exe (9f948215b9ee7e7496ce3bc9e46fda56b50cc8905b88535225c7651007f660d5) Drops a copy of node.exe as well as a malicious JS file (2cd68ea7f02e8cfaded52d64c2cb71b64560b3799c948960db37e827618ff22d) Like in my last post, you can run this through a js deobfuscato, make a couple quick edits, and the run node.exe with the --insert-brk to set breakpoints and step through the program: What you eventually get is the C2 (api.evil.com/nss), the POST data, and how that POST data is being encoded and sent out to the C2. The 16 byte buffer is the XOR key, the 176 byte buffer is what becomes the Base64 (shown here as _0xda4df9).  To date, I have not got a response back from any of these C2's. I've looked at several of these, they all so far have a pattern like ^api.[a-zA-...

  **Update** After a bit of analysis, it looks like I can force the deobfuscated code to run by "patching" following bit: "return (await _0x324dc7(_0x26c49f.HKLM, "Software\\Microsoft\\Cryptography", "MachineGuid")).value;" Once that done, I can use --inspect-brk, use dev view and set a breakpoint at the end, on the eval. In Process Hacker I can see the POST. The Payload can be decoded in cyberchef, it's Base64 decode, send to HEX, use the first 16 bytes as an XOR key, then take the remaining HEX, (From HEX) and apply the XOR key. You will get something like: {"Event":"heartbeat","MachineId":"f4f34c43-9bc1-4a9a-b55f-1d4dd97e0e88","SessionId":"125cc3b3-bc56-474d-817b-badc96d07202","Version":"0.0.2","OSVersion":"10.0.26100","args":""} Since Args doesn't return anything, it's likely not weaponized yet. The deobfuscated...

 Hello World! I created an RPG game last year for a CTF I contributed to. I am able to release this now to the public. The game, if played without using a "Cheat Code" which you can purchase in the first shop in the castle is expected to take around 4 hours to play. If you're not much of a game and you're here just to solve challenges, then purchase the cheat code in the first shop to become way overpowered, this saves you time on grinding and battles. Download the game at Itchi.io:  https://lukeacha.itch.io/capture-the-flag-2024 While this is not malware, I always urge caution. Run NW.exe to start the game. The challenge flags will be in the form of ISRMCTF{} unless otherwise stated. Flag 1: To your delight you find a treasure chest at the top of the castle tower, however, it gives a suspicious message... Is there more to this treasure chest than meets the eye? Flag 2: The pyramid is place of mystery, threat hunters need to pay special attention to the words of wis...