Clawdbot Malware

0:00Well guys, it was only a matter of time. Fake Claudebot VS Code extension installs Screen Connect RAT, a remote access tool. If you haven't heard of this Claudebot thing that the AI world of the internet has been screaming and shouting about all the rage this past weekend, it's supposed to be a personal AI assistant. An AI that just does

0:22things, get stuff done. Now, they've actually uh renamed this to be Moltbot because I think Anthropic wanted them to change the name. I've actually been live streaming some of the Claudebot security implications and setup. So, if you're interested, that's always on YouTube, Twitch, LinkedIn, Twitter, kind of trying to stream and multiream everywhere. There are a lot of really

0:42interesting things to talk about with Claudebot or Maltbot because, well, you've got the AI side of the house for a prompt injection. While this thing could very well have access to your emails, your calendar, your whole life, and your digital footprint, and that could mean, oh, hackers get in however they get in. Maybe there's an exposed attack surface if you put this thing out

1:01on the internet. I see a lot of people running around like a chicken with their head cut off on that front and I think really that's kind of overblown by default. It's just listening on the local host like loop back interface and the control UI and gateway should have some off token that's randomly generated that should mitigate some of that

1:14unwanted access. But anyway, another interesting angle is hackers, thread actors and cyber criminals riding on the hype, taking advantage of the virality and impersonating it to get malware on an endpoint. So, this blog, by the way, I'm sorry, is from Aikido uh and Charlie Ericson. And these are some cool folks, right? I think they just got unicorn

1:32status. So, big congrats. But I wanted to walk through this because they were tracking a new Visual Studio Code extension called the Claudebot agent. Now, this extension is not real. It is illegitimate. The real Claudebot team has never actually published an official VS Code extension. This is malware, a remote access Trojan. I'm going back and

1:54forth on some parts of the article because I am still seeing the extension visible and they discuss how this is presented in the Visual Studio marketplace. They include the link so we can go right to it for the Claudebot Agent AI coding assistant and this is how the page looks when I first went to it. Kind of strange, kind of sketchy.

2:14There's no real overview details. The GitHub directory that it references is not real even after the name changed. like once they changed Claudebot to maltbot, there still isn't some Claudebot- agent or Maltbot- agent repository. And this was just recently released. So much so that I think we're

2:34going to end up seeing um a little bit of Delta in that it is actively being updated. You might have seen my page refresh. Now, this is much more flashy and fancy. It's got a little icon. It's got a big boisterous emojifilled overview. Literally just before I started recording it started to change and I feel like we're going to be

2:55wrestling with like some real-time changes. So right now the extension looks a lot more compelling. Obviously a little bit more thorough and filled out read me and description here. A lot more potential poll requests. A lot more potential open issues. The thing is this is now pointing at the actual Cloudbot repository and it's pulling the info for

3:14that repo. Granted, this is just all faked and it's pointed to this repository for the Visual Code extension sort of metadata here, but they try and walk you through it and they tell you, "Oh, all this stuff to actually use this extension when it's malware." Let's dive in. I'm inside of a Windows virtual machine and I've got Visual Studio Code

3:34downloaded and available for us. And I want to tell you, I'm trying going to be working off of the old rendition of this Claudebot agent AI coding assistant. Again, all fake. There is no VS Code extension. Cloudbot is not supposed to be an AI coding assistant. It's a personal assistant. But what I've done is actually tried to download the VSIX

3:52or the actual extension metadata, not install it into my Visual Studio Code because that's how the malware will detonate. Right? That's invoking and actually falling for this scam. So, I'm going to go ahead and download the VSix. Actually, we should probably be more clear to download a specific version of the VSSIX. So, there's the 1.0 and there's the 3.0. Let me get the old 1.0

4:14explicitly just so that's not as confusing. I actually want to remove the folders and then let's just use the actual version numbers here. Okay, looks like the size there is a difference already. So, let's fall down the rabbit hole for the original extension. And what I'm going to do is actually rename this into a zip file extension because a

4:31VSIX is really still just like a bundled up archive. We can do the very same creating a copy for extension 3.zip. And then we can go ahead and extract these. Let me extract all just to this directory and do the very same with the other. So now that we have those uh created, I actually want to open that

4:50entire folder in my text editor. I like to use Sublime Text. So let's just get the extension 1.0 and then take a look at how this is made. You can see a lot of the manifest data which gives you just the raw blob info, display name, description, some of the tags, and then like the icon and things, how these were

5:08referenced and displayed. The actual information here in the extension directory is where things get a little bit more interesting. Oh, quick heads up. In this video, we're going to do a smidge of reverse engineering against a compiled binary actually written in Rust. It's doing some really cool like DL hijacking, DL sideloading stuff. So, we'll crack it open in IDA Pro and

5:28that's going to be a ton of fun. But the way we're able to do that is all thanks to the sponsor of this video. So, please let me take a few moments to tell you about Hexrays. Reverse engineering is hard. State-of-the-art binary code analysis tools like IDA make it a little less painful and a lot more powerful.

5:46IDA enables you to disassemble, decompile, and debug any application you're up against. It helps you dig into how software works under the hood, whether it's malware, firmware, proprietary software, or anything. And the Hexrays decompiler is available on 11 different platforms between x86, x64,

6:07ARM, Power PC, MIPS, and more. These analysis tools help you cut up code, unpack and deobuscate threats, investigate exploits, cheats and game hacks, binary bugs, and vulnerabilities. And IDA version 9 takes things even further with faster saves with smaller IDB databases, expanded processor

6:27support for Tririccore, Riskv, and RH850, and smarter decompilers across ARM 64, Power PC, Rust, Swift, and Golang. You'll get clearer C++ exception handling, STL structure recognition, Flirt signature improvements, and even a dedicated microode viewer to peak into the decompiler's internals. With a brand

6:49new plug-in manager, HCLI, the open-source Python API, headless processing with IDA LIB, and seamless team collaboration features, IDA gives you the latest innovations to stay ahead of modern threats. IDA doesn't just decompile, it gives you interactive control to dive into binaries, annotate, patch, and script your own workflows.

7:12And thanks to our channel partner, Hexrays, we have a special promotion just for our channel. You can use code Hammond 50 for 50% off any ID Pro product or code Hammond 30 for 30% off any IDA Pro online training. Offer expires 1 year after this video release date with more details below in the video description. Make reverse

7:33engineering easy with the ultimate analysis tools from Hexrays. Disassemble, decompile, and debug with IDA. You can get started with my link below in the video description. jh.live/hex-rays. Huge thanks to hexrays for sponsoring this video. The actual information here in the

7:54extension directory is where things get a little bit more interesting. Now VS Code, Visual Studio Code is an Electron app. So a lot of the extensions are Electron and therefore like Node or JavaScript, NodeJS running on a actual endpoint, not in the web browser. So we can get a good feel for what all of this is and what it says. Name, display name,

8:14description, version, again, publisher, and the main being the/extension.js file. But the activation events as to how this actually invokes when it runs inside of your Visual Studio Code editor. Like if you were to create a new file and start programming, do whatever you're doing in your text editor, right? Once VS Code finishes starting up, it

8:36will fire and trigger this code. You can see all the categories here. You can see all the commands to kind of look like, oh, some actual AI assistant, but it's not that. In fact, I don't think any of the code really is functional here. But we can dig into it and see for sure. We know on startup finish when VS Code

8:54runs, it will kickstart extension.js. So let's go look at what extension.js is. Taking a look here, you can see this syntax pulling in all the libraries, modules, and packages and things that we need to work with our Claudebot agent where you can see a couple variables or constants are now defined. And some interesting ones. Let me turn word rap

9:15on here. A config URL is at a weird site. Claudebot.get to maybe supposed to be like the number two to get into a PC.config.json and an initialization directory in your Windows temp path or your environment variable for the temporary directory and

9:38light. [laughter] Ah, okay. We got a couple other functions defined here. We have a lot of other functions defined here. We could kind of ignore a lot of those and just get down to the very end where we actually see this thing fire. Okay, so beyond everything being scoped into a function, the thing that actually ends up executing here could be our activate

9:58function and deactivate when it's done. But activate means that's where we realistically start. And this function, yeah, here we go. The extension activation section will first run init core based off of the context. So that's the function we'll go to next. And that just brings us back to the top. It'll immediately run fetch config and run h.

10:20That's in a try and catch statement. If it fails, it does nothing. So the exception were to be raised and the no code continues. But down here, obviously below that in the fetch config and run function, we use the HTTP library module and package to get and actually request this config URL. Then what it does is it

10:40reads through all of the data, chunks up the response, and then parses it as JSON. Once it has a response, and if the config value that it ends up uncovering out is enabled, it will then run another function download and run config.exe and config.dll. If that fails, because this is in another try and catch statement, nothing happens. So if it can't read or

11:02parse through or work with anything within this code block, nothing will happen. But if the HTTP request does get an error with an sort of on handling here, then it will run a fallback download function. So let me get us back up to speed with the iicaido blog and see where we're mapping. They are tracking the very same malicious code.

11:23Package.json sets up the immediate trigger. Activate does this. In it core, we can see download and run kick off. And they start to dig into this. They look at the actual config.json that's being hosted at that weird claot.get intopc.site.

11:44Now, at the time of recording, this was live and I can go ahead and actually download it and look at it just as well. Here's the response. If I were to go ahead and refresh this page, it's still going to be the exact same thing. That has not changed across version 1.0 or 3.0 0 of the different extensions, but

12:01we don't know what the later version of the extension is doing quite yet. Maybe this isn't part of their new attacker techniques. We'll find out. But actually, do you see what this says here? JSON blob, right, with these file names of what looks like maybe uh VS

12:21Code, right? Code.exe, the actual application for Visual Studio Code. Maybe a couple weird DLS that could be pertinent. V8 of course sounds like it's probably handling a lot of node electron stuff, but note the actual like key value pairing setup of this JSON blob. Enabled is a key that is a boolean value

12:41true, but then everything else exists in these files. But the code isn't referencing a files key. They just parse the data like the JSON response, check if the config.enabled enabled boolean flag is true and then try to download and run what it's trying to access as other keys or other properties.exe

13:01and DLL, but those aren't in the JSON blob. Like if we tried to recreate this, let me open up just like another page where we could get basically just this capability. We don't need the on error. I want to see if we can just try to have it get a config URL and get the JSON response and then see what the actual

13:23values are or what it thinks it's getting for config.exe config.dll. We could just like display those out and see if they even exist cuz I don't think that they will like this syntax is wrong. Let me try to bring this into an environment where we have node. I know realistically I should be working in

13:43like remnux or reverse engineering malware Linux distribution but I just wanted Linux super quick. So I had ki let me just run node.js and then paste in this blob. Let me see if I hit enter on this. It's returning what the object is kind of telling us for okay the HTTP call. But down below you can see the undefined

14:04and undefined. It's not actually getting the values for the .exe or the DLL that it thinks this JSON blob is supposed to have here. So the code looks like it's supposed to have all these fallbacks, but this is inside of a try catch block inside of another nested try catch block that nothing happens each time this were

14:23to fail. And if download and run down below were to actually work with undefined values being passed in, I'm pretty sure it ends up trying to stage what are these arguments in files to actually use and then download them inside of this for loop here. But because it has a now URL variable filled

14:43with an undefined value, it can't call these functions and this will cause an error. And I think this will just kind of break and die because it's not actually going to hit the on error from the HTTP request because the HTTP request did succeed. So I need your help with this actually. Can you let me know

15:04like am I missing something? Am I not reading that correctly? Reading through this, it looks like this would fail in the way that it stands right now. It is not referencing a URL. So, I'm kind of curious and part of me just wants to see um if I run this version 1.0 actually through the intended path, would it even

15:27infect the machine? It would still be cool to figure out what this malware will do or would do or is supposed to do or maybe what version 3.0.0 is going to end up doing. And there's more code that we could read through here and we could go take a look at what they're seeing in the rest of the blog post. They note the

15:44same way we had these files. The file names that are just listed here in this JSON config look like a Trojanized Electron app maybe impersonating VS Code. The file names fit. These are standard Chromium dependencies, but they ran the hashes through virus total. And these things look like connectwise

16:04screen connect. If you aren't familiar with screen connect, originally called I think connectwise control. This is remote access for usual good intentions and legitimate purposes of support like oh troubleshooting. Hey remote into someone's computer help them fix some problem whatever that it does. The thing is this is one of the most widely abused

16:25remote access capability that thread actors hackers and cyber criminals use because it is trusted legitimate and like an official thirdparty solution. Screen Connect tends to be like the number one remote monitoring and management or RMM solution that gets used and abused. That's not to be mean. That's not to be a bully to my friends over at ConnectWise. That's just the lay

16:45of the land. That's just the state of the landscape. But I got a little bit confused because they are digging into this and seeing how okay it these look like screen connect and they would end up doing actual legitimate genuine screen connect things but connecting to a rogue server like some hacker endpoint random actual location and port that is

17:08the standard screen connect relay port and it is screen connect software but been weaponized to point to and go straight to the thread actors instance so that they have control over your machine. They were able to extract this from the config. They see the usual port key value, the stuff that screen connect comes with. But I started to kind of get

17:26wondering how did they get these files? Am I misunderstanding? There is no URL specifically here. They're just listing the file names and they don't reference okay the URL that they pull these from. Like if we get back to that URL, look at the config.json here. Hopefully it's still live good. Uh, as I'm recording this, as things get changing, there is

17:48no like slashcode.exe. There is no slash dwight.dll hosted on this location. If we start to look through the rest of this, we could find no reference to code.exe or our dwight.dll or any of the others. So, I'm not super positive where those came from. And

18:09considering that this download and error for this call would die, I think I don't see an actual URL that's filled in this way for this execution path other than this somehow hitting the run fallback download function if there were not a successful request to the config URL. So if the run fallback download function

18:30were to run, let's go look at what that does. Take a look. Now they're actually passing oh okay specific values with a DL subdirectory here with lightshot.exe and lightsot.dll they download and run these and we can see if these exist. Let me go to this location. They seem to hang when uh

18:54requested by Brave some way somehow. So let's go download these quite literally. We can get to my desktop and let's use curl.exe on that with the output beinghot.exe. Will that pull down? Okay, look. Looks like that's downloading good. That one's a little beefy. And let's get

19:18DLL for the dynamic link library that they seem to be referencing. Also, that was super speedy. So, let me go take a look at my desktop. Now, we have Lightshot and Lightshot. DL. However, Lightshot.dll is 11 bytes. Um, let me open that in Sublime Text here.

19:39Drag that in. [laughter] Okay, so that one is not real in the fallback chain apparently. And the light one has a Visual Code extension, but I'm going to tell you, I'm pretty sure this straight up genuinely actually is Visual Studio Code because it has the digital signatures from real legit Microsoft.

20:02So, we've got some of the puzzle pieces here. Not particularly seeing the screen connect component quite yet, but from what it was trying to download for the fallback DL full legit VS Code and then a notreal dummy DL text file that have been passed into this. So that seemed to

20:23fail again. If we're looking at this download and run capability, it is now properly passing those arguments, writing these files and if they are an executable in the initialization directory where they're putting in the temp directory lights.exe and they'll try and execute it. But that doesn't seem to do anything meaningful when this path runs other than straight up call

20:45Visual Studio Code. I'm going to do it. I'm going to run it. It doesn't have those rest of the DLS. [laughter] Now, if I were to keep scrolling down in this version 1.0 extension source code, there is nothing particularly interesting other than what look like fake rappers or harnesses to get the AI

21:06capabilities built in like oh your open AI key, your key and then to be able to do the requests back and forth. Whether or not that actually works, I don't know. It doesn't matter because that's not malicious and not what we kind of care about. But this happens for each of these uh and the get provider and then

21:23the chat view provider was how we could actually see some of the communication within the extension itself. But the extension activation was what ran the malicious functions that didn't seem to do anything meaningful. And then these fake shenanigans to look like wow uh impersonated VS Code extension. If we

21:46were to keep looking through the rest of the version one extension code here, we see another directory. This is all just JSON copilot theme stuff that doesn't look important. But there is another folder called scripts with a run.bat which looks interesting. Little shady

22:06batch script Windows command prompt scripting here. Add echo off for the boiler plate to not show what is being ran on the command line. set local and end local to work with some local variables. And then we set the temporary directory with a lightshot subdirectory again. And then we have a new URL darkgpt private.com/d111.

22:27And if the directory does not exist, it would make the directory and then use these PowerShell commands to stage the TLS HTTP2 sorry HTTPS handler capability to download from that URL. Lightshot.exe. Lightshot.exe. exe and the DLS. Okay, so now we have a new thread to go down, right? What is this

22:48D11 thing trying to access that URL? It is a 404. Uh, if we were to get to the lightshot.exe that we know is then appended at the end of it, that gives us no response either. How about DLL?

23:08Also no response. What's on the root of this page? Login Evelyn panel. What is this? Let me view the source here. Get a little bit more insight as to what's going on. A lot of cascading stylesheets, a lot of CSS. The Evelyn PNG is presumably

23:29that is this a thing? Is like is this some malware actual panel that I should like be familiar with and I'm not? There is JavaScript that they include here. This looks a little bit more interesting. Hang on. Let me get uh syntax highlighting inside of uh Sublime Text. Let's look at like the JavaScript here. Overlay system dark mode functionality

23:52toggling dark mode, but real-time connections update without a page reload is trying to get from connections.php PHP and then update connections table with seemingly what looks like specific filters for crypto or operating system, PayPal, RAM, GPU. So, a panel like a a a

24:12threat actor cyber crime panel to use as another potential rat. This is not screen connect though obviously, but look at how they're trying to pull different potential crypto wallets here. If these were to be things that are like rendered and work with as you were logged in, just kind of at least given us clues without having a username and password

24:33to log into this thing. Not that we would. Okay, you hear me? You hear me, algorithm YouTube gods? But it's clearly something that would be able to yeah, download and even work with a cookie converter. So, I'm assuming this is some sort of kit, some offthe-shelf panel uh capability, but it was supposedly maybe supposed to be hosting these

24:56lightsot.exe and light.dll. And hey, sorry not to add even more to the mix here, but while I was editing this video, this is John from the future. Sorry. Uh, I had the thought finally to actually Google what the heck Evelyn panel might be, and it's apparently an Evelyn info stealer. And I saw a couple recent writeups on it. Uh,

25:18Trend Micro had this actually January 19th, so like a week ago. From extension to infection, an in-depth analysis of the Evelyn Steeler campaign targeting software developers, uh, which actually has some really, really neat kind of takeaways that parallel a lot of what we've been discussing here. The Evelyn

25:39info stealer campaign has threat actors, hackers, and cyber criminals weaponizing and leveraging Visual Studio Code extensions. Malware is designed to excfiltrate sensitive information including developer credentials and cryptocurrency related data just like we saw in the JavaScript. This trend micro article references some other previous work and research from Koi Koi security.

26:00So I'll take a look at that one just as well. But if we take a quick look through here, do you see any similarities? A light.exe and a light.dll put to life. Now, we have different Shaw 256 hashes, but this seems to be using actual legitimate Lightshot software, which could then end up triggering via

26:22DLL hijacking or DLL side loading. And a lot of the at least naming of this stuff sounds similar, but the real Evelyn info stealer sounds a lot smarter and a lot better in air quotes than what we have been digging into currently. like this has a whole lot more anti- sandbox

26:43techniques, a little bit more hardcore spooky scary spooky wooky stuff, but we never saw an actual genuine like Evelyn info stealer. We just think we're seeing screen connect potentially. This is the Koi security one from uh December 8th. And I like how this covers it in kind of a again similar style somewhat campaigns

27:04that are like AI powered coding assistants. Hm, of course, Visual Studio Code extensions once again. Codo AI, I guess, was that original kind of reference. And I don't know if this is being adapted. I don't know if some scriptkitty vibe code malware hacker is trying to bundle in parts and pieces of this potential

27:25attack chain. Maybe just leveraging parts and pieces of the name using lightsot.exe, lightot.dll. But we're not seeing the real lightsot application in this case. I don't know if this somehow got in the mix of what they thought they were trying to build out that did not end up being functional. Anyway, I just thought it

27:46was neat and interesting to have a little bit more insight on what the heck that Evelyn panel was and the whole Evelyn thing and a lot more references of malicious Visual Studio extensions, Lightshot being thrown around, and of course some AI assistant coding extension extravaganza. Back to the video. Sorry. Either way, this run.batch batch script is included in the scripts

28:07folder, but I don't know as much as maybe I should have for Visual Studio Code extensions, but there was nothing to actually use or invoke this run.bat in the code or any scripts directory. Does enable scripts is that what happens or something that doesn't make sense to me. Can someone again I I got to ask for help. Chat, YouTube comments, let me

28:28know. I don't see how that could be called or if it is automatically. Okay. dl/code.exe on cloudbot into PC site does not trigger but dwite.dll does. So that is how we saw and we could get the dwight.dll. Okay, I'm tracking that.

28:50Looks like ffmpeg.dll also exists here. I don't know if that is in fact uh ffmpeg or not. How about these others? ICU DTL.dll. Do those all exist? No. How about the V8 context snapshot? That looks like it exists. So, it is hosting and serving

29:12some of these, but not all of them, but not the code.exe that we're tracking. Yeah, the others seem to be here, too. Whether or not they are or not what they claim to be, I'm not positive. I reached out to Charlie Charlie Ericson, the author of this and the researcher that was kind of covering this thing. And I I

29:28was trying to ask him, "Hey, where is the code.exe or DW writedll?" And he helped me find the dwight. DLL, but uh it seems that code.exe like should have been hosted on the claudebot. Into PCs site and it was probably just removed just because we do know that this

29:49campaign is like actively changing and updating uh right now. Okay, we have the IOC's here and they give us some hashes at the very least. So we could try and go find these on uh virus total. We can get the weaponized screen connect installer. Like if I look back on virus total for that obviously it's screen connect. So that is going to have

30:08results hits details and we could download it but it's it's screen connect. So let me download this and let's get the rustbased loader dwight.dll. Let me bring those into the virtual machine here. And let's extract each of those so we can play with them. This is supposed to be code.exe. Correct. But it

30:32is actually an MSI installer. I'm a little weirded out by this. If it is genuinely supposed to be code.exe based off of like the config.json, if it had this name, if it had this name and if it were to run as.exe, exe it will fail. It is an MSI installer and that is screen

30:56connect now triggering and uh getting them access to my virtual machine. So, we're not going to let that happen. We'll say no. But dwight dl.zip is a real genuine DL this time and not just the text for dummy DL, right? DWR.dll. And thanks to the sponsor of this video,

31:16big shout out Hexrays. Thank you so much for your support. We can go try and open up the dwight DLL here in IDA. Ooh, okay. The blog covers dr.dll as the rustbased loader. And that one might be neat for us to play with because it's Rust compiled binary. So we can do some

31:37of that sweet reverse engineering in IDA. And they cover this noting that's for some DL hijacking using some DL export function dwight create factory the one that is triggered by screen connect. So if this DL with this file name were to be present in the directory that screen connect loads from it would

31:59import and run and execute this code for the dwight create factory function. So, inside of IDA, we see a couple sort of uh DL imports that it's going to be using for regular Win32 API calls. Uh what we're going to be brought to first in the control flow graph being the DL entry point, probably just a hander as

32:19to how this was attached or if it was loaded in some other specific way. Um, we don't need to fall down the rabbit hole here, but we could then see a couple of the other functions that might clue us into the fact that these are probably going to be doing a lot of the initial load things for a DLL. So, let's

32:37instead look through these other functions. And while a lot of these do not actually have a symbol that's carried with them, we could rename them. If we did a lot more reverse engineering, we certainly could. But ultimately we'll know this export this function that this DL provides which is supposed to be used for the DL hijacking is where the badness kicks in. Dwight

32:58create factory and that calls two functions here. Our little sub routine we could drill down into this and that does some cutesy stuff. We can see that it's using some of the function calls to get the current process the open process token to know what access we might have. When we look through the logic a little bit more, we could see a lot of plain

33:20text strings which are pretty interesting in here like zoom update.msi. Hm. And then maybe a temp temp run as potential string. If we trace this a little bit further, we could keep looking for other things that might stick out to us like a potential user agent and even a URL to get to Dropbox.

33:43It looks like okay, that ties that together. And we could get kind of clicking around or we could just uh F5 and try to have this thing decompile. Uh I'm okay with it using some parts and pieces that it can or can't. But this at least gives us a little bit of a cheat code to not have to drag ourselves

33:59through assembly. If we wanted to fall down the rabbit hole for a lot of these different sub routines, we certainly could. But thankfully, we could probably get a good gist here is that it's looking for this Zoomupdate.msi file with a user agent to go to this Dropbox URL. And we can get the full string here. You'll note though that

34:20includes the Zoom update. Sounds like it is actually retrieving. Yep. With internet open a internet open URL, create a file, reading it, and then writing it to disk and then actually spawning. Okay, with the token information here that's pulled from that potential temporary user to open MSI Exec and actually trigger the MSI

34:43installation of the quote unquote Zoomupdate MSI. But I'm sure you're tracking and you might have already probably seen it inside of the blog post. Let me go to that Dropbox URL. That is the raw path for the Zoom update. Bringing this down to our desktop. So, putting the puzzle pieces together, I think our Zoom update.msi

35:06is once again screen connect installer and this is what would trigger it. Requires user account control, but this is what would match the code.exe if we're to have that downloaded from what we saw in virus total. I'm still not super positive where code.exe, exe

35:26specifically the name comes in and screen connect running requires MSI and user account control so the DW write.dll might not be pertinent to that but I am curious is it actually VS code that is the one that would sideloadad that because from what we saw in our

35:48light.exe exe. That was just legitimate genuine Electron bundle of VS Code, right? I'm really all over the place on this. I apologize. I do want to see though if it is Screen Connect or VS Code that would load the Dwight DLL. So,

36:09let me open up Process Monitor and then let's look for our process name being code.exe. So now that I'm capturing, let me open up Visual Studio Code. We should look for load image uh operations. That will give us all the

36:30DLS. Yeah, that loads dr.dll. So if it is in the same directory as code.exe, it will check there first before system 32 presumably. Maybe screen connect does it just as well. So what I feel like we do is compromise oursel [laughter]

36:50run the malware in the virtual machine. Yeah, let's go ahead and actually let this thing happen so that we could see while screen connect is running. Yeah, it's running. So they must be very very happy that they just got a new potential victim. I hope you're watching threat actors and cyber criminals. And that will install as a service. So, let me

37:12get to screen connect and stop the service. And what I want to do now is get back to our process monitor. Let's not look for code.exe, but let's look for something that contains screen connect. Let's add that. Hit apply. Hit okay. We

37:32can be listening. And now I should be able to start screen connect. And let me look if it would try to have dwight DL. I don't see one immediately, but let's search for dright.dll. Ah, and there is one. There is a hit.

37:53So, I mean, it very very well end up loading that if it were in the same directory that it executed out of, but there were a lot of these moving parts and pieces that I don't know if it actually even did or could have. So, let me run it back to an old snapshot before I compromise myself.

38:09>> [laughter] >> And we are still not done because now I'm curious what the 3.0 version of the extension has changed, if anything. I kind of hope not because this video is already super duper long. Let's go see if there are any real changes to this

38:30rendition. We can open in Sublime Text and we might be able to just kind of cruise through it off the cuff, but we should probably use a good like comparison utility. Let me open the folder up just to be able to see it manually for a quick second. No more run.bat and no more scripts directory. Change log looks pretty bogus. The

38:50package.json is still on startup finished and extension.js is what is executed here. So, we're looking back into that. OpenAI provider, anthropic provider, Google provider. I am making broadstroke assessments and judgment that there is not going to be malicious code in there just based off of what we've already looked at. Dark AI

39:11chat view provider now has dark AI capability. What the heck? It's like a full-blown HTML file embedded in. What did you guys do? [laughter] What did you put in this? Where is the malware now? It's called dark AI

39:33extension in it. Core doesn't exist anymore. That will error. Is this thing still broken? They no longer pull a config whatsoever. Config. Config prefix. Never used or referenced. They took the malware out of the malware. Yeah, I

39:55don't know if I'm missing anything. again. Let me know chat if Sorry, not live streaming right now. Let me search for like all HTTP references. None of those are extremely external. There's an HTTP refer in something to

40:18point to a different GitHub repository. But dark AI VS Code also not real. Version 3.0 sucks. Yeah. So even version 1.0 would have been broken. We never would have seen a lightshot.exe or a screen connect.exe and I don't

40:39think it would have made any changes to our code.exe. That's never mentioned in the actual syntax of the source code of the extension. So, let's install and do it and just see what goes down. Like, we're not going to see Screen

41:01Connect installed. We're not going to see a light shot. We're not going to see the service created for Screen Connect. We never saw MSI Exec run. We never saw a run.bat trigger. So, even if I were to now update this thing to 3.0, you know, while there doesn't seem like there are malicious components and parts and pieces into it, we can restart again.

41:24But I think both version 1.0.0 and 3.0.0 didn't actually accomplish anything. While there were a lot of potentially cool moving parts, I don't think it actually even triggers. All right, that

41:44is the end of the video, my friends. Goodness gracious. You know, I feel like when I start recording, I'm trying to be like cool and tactical with the sweet hook and intro, and we get all the context, and we set the stage, and then when we go do it, when we dive in, when we open up the computer screen, crack it

42:00open, look at the malware in virtual machines, and we got a lot of moving parts and pieces. By the end of it, my brain's kind of mush. And I got to be honest, maybe I'm wrong in a couple of these spots. I really genuinely do want your opinion. Uh the puzzle pieces that we laid out, do they all add up? Do they

42:18make sense? Or was am I wrong? Let me know. Genuinely, the snippet on the rustbased loader, like the DLL, DL side loading, DL hijacking technique was neat and cool. And that's really what I think is really the part that shines, I hope, in this video. And I'm glad we got to crack the thing open with IDA Pro.

42:35Again, big shout out. Hexray sponsored this video. So, thank you so much for watching. I hope you enjoyed this wild roller coaster for all of the whisbang new fangled AI stuff in our AI world with Claudebot, all the security implications on that and then how hackers, threat actors and cyber criminals might be taking advantage of stuff like this with yeah sure prompt

42:56injection, the exposed attack surface and all these different angles but even just impersonating it in malware and then if the malware is vibe coded itself and doesn't work. [laughter]