Analysing How Malware Is Hidden In Cheating Software

This is first blogpost of my amateur research of free cheating programs available on code sharing platforms. We can often find repositories which contain just an ad to the developer's websites where wannabe cheaters must pay before downloading anything. I check the repos where there the authors release small chunks of code as a method to deceive players who will actually become targets of Trojans.

I find free cheating software as a great source of malware samples, because one can be sure that cheaters will do anything to have any advantage over other players, including disabling antiviruses and other system protections. This way the malicious file won't be detected nor removed from the filesystem, moreover, it will be almost instantly opened.

Contents:

Sample 1. AsyncRAT

Repository
Dropper
Malware

Sample 2. Dropper in SCR file

Repository
Dropper
Malware

Sample 3. Lumma Stealer

Repository
Malware

Sample 4. RedLine Stealer

Repository
Dropper
Malware

Summary

Sample 1. AsyncRAT

Repository

This project was created at the beggining of May, so it's up for 2 months. It's constantly updated by a workflow script adding commits every 20 minutes which keeps the repo as high as possible in searches. The README file contains some proof-of-concept images and the code uses a lot of imported functionalites. Crucial logic stays in "driver" which is a spaghetti code and is not the main point of my review. There are no attempts of making the program look legit. I highly doubt that good anti-cheat software will allow it to run along with the game.

Few fun facts:

this program tries to detect and close debuggers, but since the code has to be build by a player before running, this function can be deleted anyway
there was a comment indicating that the code was developed 2 months before release

Dropper

Dangerous code is hidden somewhere else though - I mean, there was an attempt of hiding it. Looking at the project configuration files we can notice "<Command>" XML tag. It's just one line, but 18k characters. Obviously I'm not showing all contents on purpose.
As name suggests, PreBuildEvent commands are executed before the build starts, therefore the result of the build has 0 effect on the concealed script. This implies that it's sufficient to try to build this program in order to get infected without actually using this cheat in the game.
Below is the decoded version. In lines 5 and 6 big chunks of base64-encoded code are replaced with <base64data> for clarity. I used following instructions in CyberChef:
URL Decode
From HTML Entity
Find / Replace (#xD;
 to \n)
Add line numbers
The script.vbs file is created and each echo command puts another line of code to this file. The instructions indicate that the encoded data is another script which I will analyse later. We can observe that the script redirects decoded code to another file - decode.ps1 (lines 5-16), which is then executed in powershell (lines 17 and 18):
Set shell = CreateObject("WScript.Shell")
shell.Run "powershell.exe -ExecutionPolicy Bypass -File %TEMP%\script\decode.ps1", 0, True

From the Microsoft documentation:

The WScript object is the root object of the Windows Script Host object model hierarchy. It never needs to be instantiated before invoking its properties and methods, and it is always available from any script file.

WScript.Run runs an application taking 3 parameters:

command = "powershell.exe (...)"

optional windows style = 0 (hide the window)

optional wait on return = True (Run method returns error code if there's any)

After execution the decode.ps1 file will be deleted. The rest of the script is a declaration of BinaryToScript function used ealier in decoding process, until the line 35 where finally the script.vbs file is executed with cscript.

Cscript starts a script to run in a command-line environment.

So at this point we have the following flow:

user tries to build the application
the build process triggers pre-build events that will generate script.vbs file and execute it
script.vbs will contain instructions that will base64-decode provided data, put the plaintext data into a file and exeute it with powershell.

Let's check the decode.ps1 script. Inside we have another chunk of encoded data and a few powershell commands instructing that that the data should be reversed and base64-decoded. It is then executed in Invoke-Expression cmdlet.

Plaintext data is 8458 characters long and I won't show all of it. Below is a high-level representation of the script. We can notice that it tries to download the malware in 3 different functions, which are almost the same with the biggest difference being different download URLs. Though, the file they try to download is the same - MicrosoftCorporation.7z. It's the 7Zip archive encrypted with a key provided as plaintext in the script.

function Install-GoodbyeDPI {

// downloads GoodbyeDPI.7z

// opens the archive with 7Zip

// installs and executes the program

}

function Download-String {

// helper function that reads remote file from given URL

}

function Download-First {

// calls Download-String with the rentry.co domain

// opens the archive with 7Zip (produces .exe file)

// executes the downloaded program

// in case of any exception goes to Download-Github

{

function Download-Github {

// calls Download-String with the raw.githubusercontent.com domain which contains a line with encoded payload, the payload is loaded by the script, decoded, and decrypted with a key by calling Decrypt-WithBase64

// the line is another github URL hosting malware which is downloaded (the same github user but different repos)

// opens the archive with 7Zip (produces .exe file)

// executes the downloaded program

// in case of any exception goes to Download-V3

}

function Decrypt-WithBase64 {

// simple custom decryption function explained further below

}

function Download-File {

// downloads file passed in parameters

// opens the archive with 7Zip

// executes the downloaded program

}

function Download-V3 {

// same as Download-First but different domain of the remote file - text.is

// in case of any exception goes to Paste-FO

}

function Paste-FO {

// same as Download-Github but different domains of the remote files - paste.fo and cdn.gilcdn.com

}

// EXECUTION STARTS HERE

Downloading 7Zip in case it's missing

Declaration of the function CheckAdmin

In case CheckAdmin returns true, Install-GoodbyeDPI is called

Download-First is called

The Decrypt-WithBase64 function's code is below. We can observe that the operations used are very simple and there is no attempt to use any cryptographic functions.

The same function can be rewritten in python in order to get the encrypted URL:

This script is already analyzed in virus total: link

Malware

As mentioned ealier, the file MicrosoftCorporation.7z is encrypted with a password provided as plaintext in the code.

The .exe file is instantly flagged as Trojan with a high virus total score 54/73: link

From Malpedia:

AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.

Summing up: This sample has implemented few CTF-like protections against suspicious eyes of the cheaters looking for a fast and simple cheating software. The main objective of the analysis was focused on decrypting the URLs which store encrypted malware. Techniques used:

Dropper concealed in config file
Base64 encoding
String concatenation
Decompressing files with 7Zip
Simple decrypting
Using plaintext passwords