blog.disasm.me

Open Source Threat Researcher | Casual Open Source Enjoyer

[Escalator @ptescalator]

https://t.co/8pxT4wQpzb

[blog.disasm.me @disasmdotme]

typo fix: "raquest" instead of "request" in 1/

[blog.disasm.me @disasmdotme]

#python #trojan found and reported on #pypi:

1/ Andoid Stealer via Telegram Bot with packages like "request" and "ebell". Pics 1-2.

2/ Clipper with persist. "testjsonn1" and so. Pic 3.

3/ Multiplatform stealer that looks for .env and ssh-files. "popeye-pip-v3". Pic 4.

[blog.disasm.me @disasmdotme]

@decodebytes @TrustyPkg As I can see, these packages download wannacry executable without running it, just a security research :) But anyway thanks for your work and welcome to PyPI trojan reporting!

[blog.disasm.me @disasmdotme]

Found interesting yet simple #python trojan on #pypi - "transformars" (typosquatting on popular "transformers" package).

It decrypts binary data using random.seed + random.getrandbits, and will try to unpicke this blob. It hides XMR miner.

Reported to pypi admins. Stay safe.

[blog.disasm.me @disasmdotme]

Ahh, previously mentioned package was really used by this "developer" to trojanize his own users! 11 forks, 31 stars :/

https://t.co/6VKXQ5n7Zh

[blog.disasm.me @disasmdotme]

3/
- Stealing not only #Exodus and #Atomic wallets and #Steam accounts, but also data from game called #NationsGlory (i haven't seen any malware that targets this game)

[blog.disasm.me @disasmdotme]

1/ Found an interesting #pypi #trojan today ~~

Oddly named package `buildoslibuploader` hides a multifunctional #stealer

Actions worth mention:
- Installation of extra packages via pip (why not set them in https://t.co/fXYfVYqcYJ or requirements.txt?)

[blog.disasm.me @disasmdotme]

2/
- Trust factor based based on the presence of google subdomains in cookies (but with a sad mistake in regex)
- Profiling stolen accounts not only by nitro and billing info, but also by "Discord Employee", "Bug Hunter Level 1" and other interesting badges

[blog.disasm.me @disasmdotme]

Found new #trojan #ransomware on #pypi

https://t.co/mof6EFYCLM

It will encrypt documents from your home directory using 44-bytes XOR. It's a POC, and it will drop to your Desktop folder both decryptor and key.

It also changes background on Windows :)

Reported to pypi admins

[blog.disasm.me @disasmdotme]

2/ Interesting moment: this backdoor is Windows oriented, and #powershell was preferred over #cmd according to developer's comment

And, as you can see, there is some protection against malware #analysis

[blog.disasm.me @disasmdotme]

1/ "Email checker" #backdoor from #pypi strikes again! Proud to present you a new #malware package found: "Email-checkerV2". Unfortunately, there is no extra changes compared with "Email-checker" package.

Funny: it tries to import non-default libraries before installing!

[blog.disasm.me @disasmdotme]

Found simple yet interesting #backdoor #trojan on #pypi.
Package name: Email-checker
It has help menu, how convenient!

It uses pretty popular technique that I often see on pypi: set popular #github project in metadata to automatically have a lot of stars and forks)

[blog.disasm.me @disasmdotme]

Found another #trojan package on #pypi with a pretty simple naming: discord_application. It's fairly common #discord token #stealer, no obfuscation at all.

Be careful and do not download unknown packages, even if they have obvious functionality by name)

[blog.disasm.me @disasmdotme]

3/ And what is the payload? It's a common #discord account #stealer + #chrome password and cookies stealer + discord backdoor #injector.

[blog.disasm.me @disasmdotme]

1/ Heh, what is it, #FUD #trojan?

Package saturnian by user scarycoder. Fragment of https://t.co/fXYfVYpF9b file on screen. Reported to pypi admins

[blog.disasm.me @disasmdotme]

2/ What does it download? It'a a #pyinstaller file. Not 700+ MB like last time, but only 20 MB. Undetectable by #virustotal, it's really scary... Because my system already downloaded and analyzed this file, it's 100% Trojan

[blog.disasm.me @disasmdotme]

Downloaded payload behind pyinstaller is a multifunctional backdoor, some of the comments are written in Slovak.

[blog.disasm.me @disasmdotme]

1/ Found new #pypi #malware and it's awesome!

Package named discord-install-helper is a #trojan-downloader and... the payload is 778 MB! It's a working method to protect against #virustotal

It uses #powershell to download file packed with #pyinstaller.

[blog.disasm.me @disasmdotme]

2/ Payload named "windows subsystem handler.exe" (3BF43CF03B656F71153D6E503B8961D108F1E962A3D6AD10416B614D4F7BD2BA). 718 MB of this executable is a video file "dummy.avi". It'a film called "50/50" -_-