Brian Stadnicki
Canopy Posts Tags Categories
Brian Stadnicki

Contents

Face Brain: Password stealer with vm detection

 included in malware analysis
   460 words   3 minutes 

/posts/malware-face-brain-credential-stealer/malware-icon.png

Today I’m taking a look at a password stealer filled with obfuscation and some virtual machine detection. The sample can be obtained from malshare, with an automated analysis report on joesandbox.

PropertyValue
File TypePortable Executable 64
File Size3.69 MB
CompanyNameSay celebrate Date
FileDescriptionDress Suffer fuel basic
FileVersion6.4.14.15
LegalCopyrightPine Shit (c) 2005
ProductNameAlmost publication
MD53c7c6d236721ea4cef0f904ebde6f575
SHA1d82cd631a49a175caace0fb209f7b9da16e29655
SHA256ed107d31ac4a6e8f665986e3326cc2c4551fd00ba26f5414faa8edd0f7c20061

Initial overview

The sandbox report provides us with a lot of useful initial information. It tells us that it’s attempting to steal credentials, and contains anti-analysis techniques such as dummy data, code obfuscation and cpuid.

/posts/malware-face-brain-credential-stealer/joesandbox-signatures.png

Junk data

There are several techniques used in this sample to evade analysis. For example, there’s a lot of dummy base64 strings to annoy me a bit.

/posts/malware-face-brain-credential-stealer/dummy-b64-strings.png

Among them is the string I used for naming this sample, since it doesn’t appear to have a classification.

There’s also a lot of general dummy strings.

/posts/malware-face-brain-credential-stealer/dummy-text-strings.png

Initial run

When I initially ran this, I observed a high CPU usage, probably from whatever it’s doing after loading some crypto libraries, followed by the process exiting. That’s not my expectation.

Work around

The sandbox signatures mentioned Contains functionality to query CPU information (cpuid).

/posts/malware-face-brain-credential-stealer/mentions-cpuid.png

There’s 204 mentions of cpuid, because this sample is quite heavily obfuscated.

To defeat this anti-vm technique, there’s a great post on Sina & Shahria’s Blog about it.

I don’t know which registers are being used for this detection, so I’ll write over them all:

cpuid.1.rax="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.rbx="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.rcx="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.rdx="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.rex="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r8="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r9="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r10="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r11="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r12="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r13="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r14="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r15="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"
cpuid.1.r16="0---:----:----:----:----:----:----:----:----:----:----:----:----:----:----:----"

I append this to my vmware virtual machine’s .vmx file.

Continued run

Now that the anti-vm detection has been defeated, I can focus on the stealing part itself.

The code is heavily obfuscated, complete spaghetti, so I’m not going to bother with a lot of static analysis, simply what’s going on in procmon.

Data collected

DataEvidence
Computer Name/posts/malware-face-brain-credential-stealer/evidence-computer-name.png
WinSCP sessions/posts/malware-face-brain-credential-stealer/evidence-winscp-sessions.png
FileZilla credentials/posts/malware-face-brain-credential-stealer/evidence-filezilla-credentials.png
Firefox credentials/posts/malware-face-brain-credential-stealer/evidence-firefox-credentials.png
Microsoft Edge credentials/posts/malware-face-brain-credential-stealer/evidence-microsoft-edge-credentials.png
Yandex browser credentials/posts/malware-face-brain-credential-stealer/evidence-yandex-browser-credentials.png
Brave browser credentials/posts/malware-face-brain-credential-stealer/evidence-brave-browser-credentials.png
Opera credentials/posts/malware-face-brain-credential-stealer/evidence-opera-browser-credentials.png
Google Chrome credentials/posts/malware-face-brain-credential-stealer/evidence-google-chrome-credentials.png
7 Star browser credentials/posts/malware-face-brain-credential-stealer/evidence-7-star-browser-credentials.png
Amigo browser credentials/posts/malware-face-brain-credential-stealer/evidence-amigo-browser-credentials.png
Cent browser credentials/posts/malware-face-brain-credential-stealer/evidence-cent-browser-credentials.png
Chedot browser credentials/posts/malware-face-brain-credential-stealer/evidence-chedot-browser-credentials.png
Google chrome SxS credentials/posts/malware-face-brain-credential-stealer/evidence-google-chrome-sxs-credentials.png
Chromium credentials/posts/malware-face-brain-credential-stealer/evidence-chromium-credentials.png
CocCoc browser credentials/posts/malware-face-brain-credential-stealer/evidence-coccoc-browser-credentials.png
Comodo browser credentials/posts/malware-face-brain-credential-stealer/evidence-comodo-credentials.png
Elements browser credentials/posts/malware-face-brain-credential-stealer/evidence-elements-browser-credentials.png
Epic Privacy browser credentials/posts/malware-face-brain-credential-stealer/evidence-epic-privacy-browser-credentials.png
Kometa browser credentials/posts/malware-face-brain-credential-stealer/evidence-kometa-browser-credentials.png
Orbitum browser credentials/posts/malware-face-brain-credential-stealer/evidence-orbitum-browser-credentials.png
Sputnik browser credentials/posts/malware-face-brain-credential-stealer/evidence-sputnik-browser-credentials.png
Torch browser credentials/posts/malware-face-brain-credential-stealer/evidence-torch-browser-credentials.png
Ucoz Media Uran browser credentials/posts/malware-face-brain-credential-stealer/evidence-ucoz-media-browser-credentials.png
Vivaldi browser credentials/posts/malware-face-brain-credential-stealer/evidence-vivaldi-browser-credentials.png

Calling home

Once all the credentials are collected, it sends it back to a server from a Lithuanian hosting provider that is a known spam hoster.

/posts/malware-face-brain-credential-stealer/call-home.png

Conclusion

This is a fairly comphrensive stealer in terms of browsers, and it’s certainly very well obfuscated. However, it doesn’t detect its environment well. The anti-vm can be easily defeated, and it doesn’t even check for debuggers, nor analysis tools such as procmon.

Updated on 2021-12-21
 reverse engineering, malware, stealer, anti-vm
Back | Home