So now we are going to do a static analysis by using the spy.
And since it is a 32 bit application, we are going to use the 32 bit version of The Spy.
So I already opened my 32 bit spy here.
Now I'm going to load this in malware inside the Spy.
And let the analyze and decompile.
And from here you can see the basic information.
About assembly name and so on.
And the assembly company is mini to.
Solution assembly description is mini to power data recovery.
And this is just a fake description because this is actually a malware.
And from here we can see the entry point is gone.
Camp dot main.
So I'm just going to bring this down here.
All right.
Let's click on this to go to the main.
And here is the main and you can see here Gorny camp is a main class.
And inside here you can see there are many other classes as well.
Dynamic Encryption file Zilla, Imvu, Social networking stuff.
Internet Download Manager Jdownloader Key Hook Paltalk Recovery Browser's Recovery mail and all this
gives the impression that it is a password stealer for mail as well as browser and then sent here.
Sounds like it is a connecting to the command and control server.
And finally you have this one strange looking one which seems to be obfuscated and we are going to deobfuscated
it later using the four dot.
But now let's take a look at our entry point, which is Kony camp.
So to just click on that and just go to the entry point.
From here you can go to entry point.
Okay, So this seems to be entry point.
The main function, as you can see, the main method.
And here you see the many threads being created, each for certain functionality.
And finally at the bottom you have the application run.
So this runs the main program and this gives the impression that it is some kind of remote access to
package where you can customize the Trojan or the rat that you want to distribute, and not necessarily
all of them will be enabled.
So let's see if we if we click on the first one show message.
So it's blank.
That means this is not enabled.
Click on the backspace, click on this Add to startup, also not enabled Backspace website blocker also
not enabled backspace website visitor also not enabled.
Backspace self-destruct also not enabled backspace get current window so get current window seems to
be enabled.
So this seems to be a kind of key logger and from here is trying to create some of the content of the
key log like Windows title and the machine time and the keystroke type and so on.
And if you want to get more information, you can actually search for this keystroke log to see where
is being used so we can search for this right click and find.
And here you can scroll through the list of places where this is being used and keystroke log is used
in this function, this method called record keys.
So here you can see it is capturing your keystrokes.
It sleeps for a certain number of milliseconds and it goes in a perpetual loop where it keeps on recording
your keystrokes.
So here is capturing the key log keystrokes.
And down here it seems they are sending it somewhere.
So let's click on this link and see where it goes to.
And here you can see this is the URL, the command and control server.
So this could be your indicator of compromise and this would have showed up in the dynamic analysis
as well when we did it earlier.
Okay, let's click the backspace to go back here.
All right.
Now, let's continue.
This time we click on this method called send Log.
And here we can see that send log is actually trying to send something to the command and control server.
Over here you have a web client.
And the download string here is getting the information back from the command and control server.
And here you can see the machine McKinney machine time in reverse, probably some attempt at obfuscation.
And here we see password in reverse.
And here you see clipboard in reverse and here is a screenshot and notification.
So these are the things it is probably trying to capture based on the response, the command coming
back from the command and control server.
All right, so let's go back now to the previous location to remain and continue analysis.
And here we see we have get record keys.
So these are the keystroke part which we have already seen.
So back send notification.
So nothing here, it seems it's not it's not enabled.
And add hotwords is also not enabled clipboard logging.
So this one is where the malware is trying to steal the information from the clipboard, including the
time, the text and so on.
All right, so let's go back now to look at the main again.
Next one set apartment state.
All right.
It's not enabled, it's blank.
And here screen logging not enabled download and execute not enabled backspace execute and binded files
also not enabled and password recovery.
Yes.
So we can see password recovery is one of the main things it is doing.
There are a lot of things happening here.
All right.
So let's take a look at the first one.
These are all the clients for emails and also web web browsers.
So let's take a look at outlook first and here outlook function will call this function called fence.
And then fence in here will be doing some kind of search for something in the list.
So let's see, what is our list.
All right.
So we need to search for our list and see what we get our underscore list.
All right.
So it seems that this list is populated through this function with mail.
So let's follow this.
And here read Mail is trying to get the folder path to this mail dot txt.
And this is what we saw earlier on when we did the dynamic analysis.
Okay.
From here you can see that it is trying to store the content of the email in this file, but before
it can store it there, it needs to go through the process of extracting information from the emails
and probably this is how it does it.
It is trying to execute this string in reverse which reverse it.
It will be get executed in assembly and then after that resource manager and then it will execute the
web path and then it's going to get something from the resource manager and then it's going to decrypt
it using this function.
RSM Decrypt.
All right, Let's click on this to see what it's doing.
So it is getting something from the resource manager.
The resource section of the file, key resources, probably this or this.
And then it is using RSM to decrypt it.
So let's see what is decrypt.
Click on it.
And you can see here, this is the decryption routine that appears to be a symmetrical decryption routine.
So probably it's is not RSA because RSA is asymmetrical.
So this one gives a hint that this symmetrical encryption so is using this to decrypt whatever is in
the resource section.
Okay, let's go back and see.
So this is RSM Decrypt.
So it appears from here, the resource manager, the resource that is trying to get is key.
So let's go and look for the resource.
There you go.
Key resources.
Look at this one.
Over in Hex Editor.
All right.
So this seems to be encrypted.
All right.
Let's go back to our path, our assembly, which you analyzing the main function.
Click on the back.
We can close this.
All right.
So coming back to this function, which we were looking at.
So it looks like it is decrypting the resource.
The two resource we saw just now and then executing it over here.
So we need to somehow find a way to decrypt this, decrypt the resource session.
The resource session might be a executable embedded executable.
Okay.
So in the next video we will continue with this one where we will decrypt the key resource here to see
what is inside.
So I'll see you in the next video.
Thank you for watching.