Full transcript
0:00Yesterday, I received this email with the subject malware distribution via Google Ads. It says, "Hey John, you might want to check this out before it's gone." While searching for the Bing Webmasters login page, they include this screenshot and they indicate that they were searching in Google for Bing Webmaster Tools and one of these second sponsored results looks like a regular
0:21search.bing.com. But, when you look at the inspect element here, you might see something strange. This data- pcu like HTML attribute is set to a URL https of bing.com, but then a comma and https markov-chains.com. Now, I kind of need your help here
0:42because for one thing, I can't recreate that search result to get those same sponsored results. Google Ads are super duper dynamic and variable based off of like your region and everything else. But, if I were to try to have something that did have some actual sponsored results that come back, like if I search for Huntress and here is one of the
1:02links that we could just inspect. Take a quick look at the inspector tools here. That entry data-pcu does have the link to huntress.com. So, the first wondering thought that I had was was that comma like separating two different URLs something unique or something interesting? But, taking a look at another result here, let me go ahead and inspect, all of the other HTML
1:23attributes look just about the same as what we saw in the email screenshot, but here's another instance of the comma and then another domain ad.doubleclick.net. And I would assume that's where actual Google Ads tracking, but the same thing happens with the data-rw URL for google.com/aclk and then a whole lot of this nonsense here. That's the actual href anchor. So,
1:46if I were to even go click this link, let me hop to the network tab and as I go here, you'll see at the very top, we never really went to an ads.doubleclick.net. We did go through Google ad services.com and the eventual hit of the google.com/aclk that we would expected for ads tracking. So, I'm not super positive if that does
2:09actually drag you to the markov-chains.com page from this potential Google malvertising. If you happen to know what is actually going on, please do let me know in the comments, but continuing on in the email, they say clicking that link would maybe lead you to markov-chains.com/category/lectures. If we were to go to that page, this is
2:32kind of weird. Um, it doesn't have anything really well displayed here. Maybe a broken page with like latex page. You can see a WordPress favicon. So, maybe a WordPress site. But, if we were to inspect this page, you'll see something odd. Handful of things that are related to the actual site itself, a little bit of WordPress breadcrumbs, but
2:53occasionally you'll see an inserted, seemingly, link to preload as a script, some other domain slgnahrfs.com/redandrandom.js JavaScript. It includes this here on lines 59 and 60, and it does the very same again on 73 and 74, and then even
3:15after a handful of links, it does it again on 142 and 143. Now, taking a look at this JavaScript, uh, it's that. So, you know, JavaScript. I don't like dealing with JavaScript. I don't really want to. So, we're going to throw this into webcrack and see if it can deobfuscate any of this nonsense. I don't think it'll do a super good job,
3:35but it'll give us something. You can see this barely cleaned it up, but there is it's still a giant blob of what looks like base 64 data, and then some character codes that were at the top, but at the very bottom, it kind of decorates all this and stages it, and then ultimately calls some sort of function. So, let's just see if we can
3:52sort of kind of recreate it by letting this run in sort of our own console here. Just the parts and pieces before calling up a function. I pasted this all in and now we'll be able to see what that last sort of variable is that they keep adding on to. This underscore BC9F7 and that is a whole lot more uh
4:14seemingly readable code. Let's try to actually display that out so that we can have all the new lines presented here. Let's copy that and I'll throw it in a Sublime Text text editor where we can set the syntax to JavaScript and this starts to be kind of weird. Honestly, we could just throw this right back into WebCrack, but you could start to see
4:35some sketchy stuff that it's presumably at least adding some detection for. Hey, super quick, before we go any further, please let me take just a moment to tell you about the sponsor of today's video, Vanta. Risk and regulations really are ramping up and customers expect proof of security in order to do business. Vanta knows that's a must-have requirement.
4:56So, they synthesize compliance, risk, and customer trust all into one streamlined solution. They automate your compliance process with an AI-powered platform. So, whether you're prepping for SOC 2 or maintaining your GRC program, Vanta handles the hard work for you. So, you can keep your business moving because even in the age of AI,
5:17security is still hard. It's harder than it's ever been before and trust can make or break your business. You and your security team, alongside other security leaders, are juggling everything. Protecting your entire organization, not to mention customer data. But, while the industry is moving too fast, you still got to keep up. Vanta helps streamline
5:38and safeguard your security program. Companies like Ramp and Rider spend 82% less time on audits with Vanta. They're trusted by tens of thousands of companies to unify risk, compliance, and trust. In fact, they're the number one rated GRC product on G2 reviews, a leader in the IDC market space, and they've been recognized by Fast Company
6:00and Forbes for innovation. The Vanta Agentic Trust Platform plugs into your existing infrastructure, so you have a continuous single source of truth. It flags the issues that actually need attention and automates everything else, so you aren't bogged down. That's Vanta, a solution to enable your trusted security program. Don't get stuck trying
6:21to prove it. Get out from under it and stay on top of it. Vanta helps clear your path, so you can grow confidently and stay ready for anything. You can get started with Vanta with my link below in the video description. jh.live/vanta. Huge thanks to Vanta for sponsoring this video. Let's throw this itself right back into
6:41Web Crack and then see if it can clean it up a little bit better. Okay, so a handful of potential icons or assets for random different things. WeChat, WhatsApp, Zoom, WordPress, Google, and then they put together this config for an API path that has slgnr or slgnrefs.com.
7:02No ahrefs there. Wasn't the original page yet with a slgnaahrefs. Weird. I assume red meant for redirect, and then all these things it's trying to detect and then have some cloaking, presumably. I'll turn word wrap on. I presume we're looking at, okay, the kind of the beginning gate of a phishing kit,
7:22right? Detecting your navigator, checking if it's in what it would expect. Yeah. Ooh, even trying to check if it has some uh VirtualBox or VMware artifacts that it could key off of to know whether or not you're real or not. We could carve out that HTML, but I don't want to get too far trapped down this random rabbit hole of JavaScript
7:41that we just saw on that strange website. I think that API endpoint was what we were curious about. And okay, goodness, where is that in the config? What would this give us? Back again inside of our own interactive console. There we can see that gives us this URL. And presumably this could determine where it would load from. So, without
8:02falling off a cliff here, we can presume from this weird random JavaScript, right, that this endpoint is probably what's going to return some server-side controllable redirect location. Because it does like make it look like we are going to redirect, at least with just some smell of the code, not reading this all while it is still obfuscated a bit.
8:21But that bundle of random JavaScript does make this Google Ads malvertising malicious advertising scenario a little bit more feasible, because it makes sense to me if it is tracking, "Oh, you came from that URL." It then would then inject enough of the JavaScript to actually point you towards and redirect whatever the API returned at that time,
8:43which could very well have been login.truyenaudio.com. If we were to hop over there, that is Bing sign-in. Granted, it's a Microsoft page, but it's fake. This is our landing lure, right? This is where presumably they would want to go ahead and steal your credentials, maybe. Or at least
9:04guide you through enough of the process that you're providing username and password. But this looks awful, right? What the heck? >> [laughter] >> Let's just fill in nonsense here. A@a.com. Password is the letter A, of course. Ah, but a security module is required. And we need to install the Microsoft security module on this device. So, let's download that. To
9:25complete the installation, you just have to run the installer you downloaded and then return to this screen. Oh, I like the trickery here. They don't let you click this button and they say if the installer didn't start, return to the previous step and try again. Yeah, okay. So, the file that that downloads is hilariously called microsoft.bat and that .bat is a bat extension for
9:43like a batch script or running a sequence of cmd.exe or command prompt commands. Some boilerplate here, you can see the @echo off to disable a lot of command output, set local enable delayed expansion to use exclamation points to indicate variables and have some extra perks when trying to call functions here. Set some variables for max retries, retry count, a label here to
10:06retry, so it's probably going to loop, of course, trying over and over and over again, where it, of course, uses PowerShell bypass execution policy and run a command. And it's neat they're using the carrots to add new lines even within batch. But obviously, we end up reaching out to this IP address and grab some strange text file and then execute
10:26it with IEX as code, after, of course, we download it with IRM. These are PowerShell aliases, right? IRM to invoke rest method or retrieve some information from a website and then IEX to invoke expression. That's basically eval to run more code while it's provided first as text or as a string. So, whatever this website displays, this endpoint from
10:48that strange IP address, will be executed on your computer. So, let's try to go see what that is and what it would contain and presumably it will be more PowerShell code, right? Because PowerShell is the one invoke rest method retrieving it and downloading it and then IEX invoke expression to actually run it. Will this connect? Is it still
11:08online? Yep, do it anyway. I know we got to be over HTTP. So, that IP address is not responding right now, but thankfully, I had gotten to this previously and I saved a lot of the payloads and we could see what this stage two would have been. Of course, more PowerShell, so let's set the syntax there. And this is doing some strange
11:27stuff, right? Here we're using add type to be able able some managed assembly, managed code and we'll want to grab some Win32 API functions like ShowWindow and GetConsoleWindow. And that's kind of clever because they end up using that, right? The namespace being the letter H in the sort of module that they're calling this thing is as W, so they can
11:45reference from that the ShowWindow function, and then actually get the console like PowerShell, the window as it is open, and then hide it. Like, don't show the window, which is funny. And then it goes ahead and stages this $call.text F variable so that it could go grab it, determine if it exists or not, and if it doesn't, it will go ahead and create it,
12:05being the directory or the place for it. That D variable was of course the split path, so it's creating the directory first, and then it will download this file uh from the same IP address, a script.php, and then execute that. With the ampersand in PowerShell to denote will run it, and as a script block type, all of the contents that were stored in that
12:26F variable where it was downloaded to. So, that is our stage three, if we want to call it. With the site being down, thankfully again I do have this staged already. That defines a giant GS variable, which is a lot of base64 nonsense blob of some sort of data, but then a couple other variables like Q and
12:44N that look like they're going to be used for a smidge of crypto. You can see that those are decoded from base64, then they grab an AES object, take out the key, the initialization vector, and the mode, and then they decrypt that. The final variant that they have here, HX, they once again use IEX to invoke expression. So, that would, after it's
13:05decrypted, get us to stage four. And we could throw this into CyberChef if we really wanted to, but ultimately, since this is just PowerShell code, we could grab everything before the IEX so we don't detonate this or run the next stage ourselves, but then we could just let the code unravel itself. Just to be on the safe side here, I am going to
13:23work inside of a virtual machine. We'll open up PowerShell just so we could have the interpreter. And once that staged, we'll go ahead and paste all of this in. >> [laughter] >> We should probably have done that as a script, so we don't have to watch all that scroll, but anyway, it craps it out. Now we'll have this HX variable
13:42that we could go ahead and explore. And there's more code. So this is our stage four. Uh PowerShell error action preference is to stop, so it will just bail out if anything were to go wrong. We do have an installer URL to a hosting.iptusb.com and that. I'm going to assume that's probably stage five or our final payload, right? But look at these
14:02comments. Um a language that I don't speak, so I'm curious if you in the comments have any uh insights. But look, tracking a logged user, getting the explorer, and uncovering the oh logged-in user via explorer process. That's kind of neat. Uncovering it a bit more, but then they stage a public path
14:22for C users public SVN. I feel like I need to run PowerShell code through Google Translate. I've never had this predicament before. Puts it in a random number, and then uh goes to probably oh yep, stage a setup.exe based off some of the date values. Downloads that installer, and then tries to run it ooh
14:43with Inno Setup. And a couple of the arguments here to uh stage what it will do. Inno Setup is one of those well-known types of installers. It's pretty easy, but they end up then creating a scheduled task. And then once it is successfully installed, um it cleans things up. Neat though that it has a flag file or something to kind of
15:04indicate the fact that like okay, this already ran. Now from your appdata directory, local appdata, and then a machine counter. So then we could check as to whether or not it works. Okay, and it prepared some information to notify further C2 to indicate what host name, what username, what country, and what time uh they infected that host. Okay.
15:26Is this thing still up? This was the alleged C2 thing, but how about that installer? That's still up? That's still up. So, to look a little bit further now, I am going to open up REMnux, the reverse engineering malware Linux distribution, and I downloaded the installer.exe,
15:48and that is, if we were to just simply take a look at the strings there, do we see any indicators of Inno grip up I Inno setup? Yeah. So, you can use tools like Inno extract and a whole lot of other things to be able to explore those, but that might not work the best on that version. So, I am actually going
16:06to hop back to Windows, and we can use the Inno unpacker, and that's just a GUI application that tries to combine the Inno un P or unpack that has some versions up to 6.1. I guess there was another Unicode version that's up to 6.72. So, we should be able to get this one,
16:26and at risk of, you know, downloading and installing random things, at least we're in a virtual machine. Let me run our Inno unpacker that I've installed and set up, and I've opened the installer. Puts in a default directory of local app data helper tools, and the general information is just that. The file listing gives us a lot of strange
16:45things. Connect VPN.exe, a package MSI installer, send RPT, and Tortoise stuff. Tortoise blame, Tortoise merge, Tortoise plank, Tortoise proc, Tortoise stub, Tortoise SVN. Ah. And a website.url, and then the Inno setup install script. Default language is
17:06English. Verify, I think everything is fine. Yeah. Okay, so we can just extract these now, couldn't we? Yeah, let's put them on our desktop in an extracted folder. Let's create that. Now it has extracted it and we have that directory here. So, the install script is probably everything that we've at least already noted. I like that. Uninstallable? No.
17:27Lowest privileges required, wizard style, and then all the files that are included here, and then it does add into the registry. Oh, a run key to run Tortoise SVN, but specifically Tortoise Blame.exe. Okay. What else is in the files here? Auto
17:47list? I don't know what that is supposed to be. These look like regular expressions for files, but I don't know if that's for Tortoise SVN things. If this is a legitimate program, there's a package, there's all this stuff. Let me run website. Okay, yeah. Tortoise SVN. SVN Subversion was like clicking in my brain, but I didn't know like this is is
18:10this backdoored? Is this malicious? Where is Tortoise Blame? Tortoise Blame, who changed which line when and why? Is there a way to download this thing cuz I want to like compare and contrast what is different between what this malicious track gave us versus what the actual software is. That's probably all in, I guess, the original package, right? Oh,
18:30what version do we have? I guess we can look at the DLL, right? Would that show us a version? That is signed. Details, 1.14.9, presumably. 1.14.9, cool. We're probably 64-bit because I see the other 32-bit things alluded there. Let's download that. Oh, but
18:50that's an MSI, not the Inno package. Is that the same as our original package cuz that's an MSI? Let me try to install the real Tortoise SVN, and then we can look at what the malicious one would be doing in like a dynamic sandbox. How about that? Okay-dokey. Would that have actually installed things into Tortoise SVN? Okay, that
19:13still includes auto list and connect VPN and the stuff that we thought we saw coming from Okay, and package on it. So, this is like literally a bundled up but presumably backdoored rendition of genuine TortoiseSVN. But, what are they hitting with blame? Why does that happen? Why do they trigger that specifically? Let me try and put these
19:32side by side. We have malware on the left and we have uh legitimate software on the right. Ooh, this actually stands out like a sore thumb now. Look at the timestamps on all of these. 2024, 2024, 2024, 2024 everything. But, then this one obviously you could see it sort of offset the package and that is on 2025.
19:50So, it's got to do some like DLL side loading likely just with that, I think. Maybe? I mean, obviously this is just speculation. We haven't tested or looked at any of that. But, everything else is 2024 except for aha, VC runtime. And that would totally be uh pulled into it just as well. But, these are from real
20:08Microsoft. Like, those are all signed. They don't look like they would be tampered with. Realistically, we should probably like run Procmon or some Sysinternals tools to be able to see what is it loading and is it any different from what the malicious one would load. But, to speed run for the sake of a YouTube video, let's just
20:24throw ahead and chuck this into a dynamic sandbox. I'll put this in the desktop. We can crank it up to run for a long, long time and do it. But, here we go. We see Tortoise Blame firing off already. So, see why and how does this Tortoise Blame.exe trigger? But, it's in appdata local helper tools as expected.
20:43I'm assuming this is going to be different than what the actual TortoiseSVN utility is. It's thinking it's finding Confuser, connecting to web sockets. Oh, yeah. Okay, that's strange. Probably not something that uh actual subversion software does. But, it's making some connections right now, isn't it? Tortoise Blame going to random IP
21:04address. That domain main.webkratos.ddns.theguru.com. Is that normal? What did that return? That's HTTP. Okay, so it was a redirect or trying to upgrade a websocket and then it redirected. So, it said go to page that that. What why? I would hope this is not what actual Tortoise Blame
21:25does. But that one's trying to reach out to that and actually start a websocket. Is that like using a websocket for command and control? Cuz that's kind of neat. Hey, sorry. John from the future here. Uh I was editing this video and you might have seen the text overlay because I felt bad. I didn't run this to ground
21:41and I missed what was the smoking gun that would lead to kind of the end and the final payload of this malware. We got to see it within any.run a little bit, but I missed it. While we were going through this, it is this crshhndl.dll. Now that is present in the actual application, but if we take a quick look
22:00at the properties of this one, you can see that that one is actually signed and that has the correct timestamp of uh November 2024 and that file size is like what? 201 kilobytes? Over here on the malware side, we take a quick look because all the other things that we're looking at were like legitimately signed Microsoft DLLs for probably .NET stuff.
22:21But this crshhndl.dll in the malicious package is not signed and obviously that has a different timestamp. You can see the May 24th. So, just as this campaign was probably kicking off in a much larger file size. So, there we go. We found it. That is the DLL side loading, DLL hijacking,
22:41however you want to call it. One of these libraries in the files that actual Tortoise or Tortoise Blame right would end up loading is going to pull in this file. But now that this has been replaced inside of the malicious package, it loads their malware. Really funny as you hover over it, it's pretty clear this is web client DLL of web
23:00Kratos. And that is while we could look at it in Detect It Easy, PE Studio, or whatever, I just like to use the file command. It is a .NET assembly. So, we could just as easily open it in like DN Spy, IL Spy, .NET Peak. And here it is in .NET Peak, and let me tell you, it's
23:17again pretty egregious. Web Cratos client library DLL build for native host integration. And if we go take a look at all of these parts and pieces here, the Web Cratos client, let me look at that bootstrap class. Here you can see kind of outright that is that web socket command and control, but you'll notice all of these little functions,
23:38everything that it's trying to work with here, uh .NET Peak cannot decompile. Another interesting constant string here, in case that's of any uh indicator of compromise for us. A lot of these other classes, as we would start to explore them, oh, and there is a heck of a lot more in client core, capture mode, clipboard helper, input simulator,
23:57keyboard hook, and screen capture. That was what Any Run was tracking, of course, the web socket connector. Here's the thing, I am not really all that well able to drill down into each of these, even if we were to try and look at it in like IL Spy, opened it up here just to see, a lot of these others, if we were
24:16to expand them, you probably already caught it even just in the assembly definition, and you can see these like gross, super obfuscated, completely mangled, and unreadable Unicode shenanigans. Look at this. Confused by Confuser Core. So, it is using Confuser, Confuser X to be able to totally obfuscate and mangle that binary. Now, this is not a video in
24:37trying to reverse engineer and deobfuscate Confuser X, uh cuz it's already long enough, but we found it. We tied it all together, and now we've at least definitively, okay, tracked down it, yeah, okay, that's malware. If we weren't sure before, we're sure as heck sure now. Is that like using a web socket for command and control? Cuz
24:53that's kind of neat. What is that page? So, going to the web socket client page, obviously it's going to whine, but um Is that a thing? Is this supposed to exist? I should have put two and two together to search for that because it looks like Kratos No Before has some inside out about a
25:14fishing kit or a fishing as a service kit. And that's sort of reason, right? February at least of 2026. Do we see anything that ties it to the same sort of thing that we have seen? Yep. Yep. Yep. Yep. Yep. Fishing, social engineering, fishing emails. Oh, the Kratos administrative interface. This looks a lot like kind of what we landed
25:36on, doesn't it? Like it's not identical, but it looks like it. Okay, I got to stop recording. This has been a long enough video, but thanks so much for watching. Hope you enjoyed. Hope you learned some tricks along the way. Please do all those YouTube algorithm things like, comment, subscribe. And please do give some love to our sponsor. Huge thanks
25:52for all their support. There's a link below in the video description. See you in the next video.