Evgen Blohm - Iranopasmigirim - Unmasking an ever-evolving GitHub-Hosted Espionage Campaign

Heat. Heat.

Yes. Thank you very much. So, welcome everybody. Thanks for having me here today. First time Ljubljana for me. Ljubljana Talen, sorry. Estonia. And my talk today is about more some threat intelligence topic, some research we did uh where we tracked a Iranian threat actor who's targeting uh dissident internationally. And what I want to talk today about is how we tracked it, some tips and tricks you can use in your own research if you want to do some threat actor tracking and some infrastructure tracking and some research in general. So it's just some things you can use on your own and just give you a behind the scenes uh view about the threat in particular because luckily for us the

threat itself did some OBS sec mistakes so we were able to get some more information about him and just to get a clearer picture of what exactly he's doing. Yes, perfect. So before I begin um just a little bit about myself because maybe at the end of the day we'll all become friends so you know who I am. So my name is Oen Bloom. Uh that's me sitting here right here in the self-made car. I had a small crash but I survived. I'm instant respondent infog. Uh so I'm dealing with ransomware business email compromises stuff like that on a daily basis and whenever some time left I do some research like this one. I was already

speaking few bides and just to give a quick overview of what I like to do in my free time. I'm an avid hobby cook as you can see here my barbecue um like to ride gravel bike around Denmark recently and I enjoy going to pups. So as my first time in Talen if you have some recommendations hit me out know where to find me. So just a quick overview of about what I'll be talking today and I see a lot of monitors I can use which is really nice. So basically just like introduction on how you can get started like how you can find such initial traces which you can then like investigate a bit further. Um then we

will look at the campaign itself. So basically what this campaign was doing how was happening who are the victims or what at least are the target victims. Um this campaign used some different lurs. So basically on how to inract uh victims onto executing the mware at the end. Then we'll look at the mware itself. There's going to be some different evolutions generations of the same mware. we would take a small look inside it. I'll not do any reverse engineering here today. So, um that's fine. And there was also some test builds uh which we found which also take a look at just to see like what exactly some threats are doing. Uh lastly, OBSC attributions.

So basically what were some operational security failures by this threat actor? What are some things you can look for by yourself if you want to track such actors or generally just actors if you want to find more information for threat intelligence for yourself just for fun and research or sharing with agencies whatever and lastly just quick summary so um just small disclaimer so basically there's also a blog post about this so if you're more like the type of I like to read not listen just go there uh if you're more the type of I like to listen not read say here and also all this information was already shared German uh government agencies because I personally

think it's really important because that's like the way you can actually contribute something help those agencies notify the victims and so on. So again if you do this kind of research I personally would advise you go out to your local government entities just share the information and they can maybe action on it if you can't do it by yourself. So how it started and that's actually pretty funny thing. So, uh, basically the story was I wanted to meet up with a friend. I haven't seen him for a long time. Want to grab some beers, grab some food on a Friday evening, and he can on me in the last second. So, we're sitting around Friday evening and alone by

myself at home. And what exactly do you do on a Friday evening, you look at more web. So, that's what you do. So, basically what I was doing, I was collecting new samples from Mware Bazar. That's a place you can upload and download Mware. If you don't know it, they have like recurrent malware. It's pretty open so you need an account but uh it's not paid or anything. It's free. So if you want to look for new samples and you don't have like a paid virus total license whatever just go to mo bazar they have some good feeds there which you can use. They also have other services like warehouse flatf fox and so on. And basically my idea was just get

some new bunch of malware test my local Yara repository against it and see if there's like stuff which my y roots do not find and then develop y roots for that. And I found an LK file which was labeled as unknown. So basically what that means is whenever you upload some files there's some AV engines in the back some other service being used by Mo Bazar to give you like some kind of attribution what the sample is maybe the family whatever or some labels this case was unknown which is pretty interesting from research point of view because it means the sample is like kind of unknown more or less. So let's take a look at

that. And basically again was a link file so I can't do too much and basically what it was only doing was downloading three additional files hosted on the same GitHub repository and execute them and we will take a close look at these f free files now. So whenever you have a link file and you're doing some threat actor research attribution or whatever link files are really great because link files by themselves by default contain a lot of metadata which you can use. So in this case if you take a look at the um values highlighted here you can see some really important things. So you can see for example the creation timeline uh time stamp and modify time stamp these things

can be modified. So keep that always in mind when you do such kind of research but it can be modified but not every fractor knows that not everybody fat does that. Also you can remove most of the other things but again not everybody does that. So it's always good to look if you have these values. We also have like really interesting value at the bottom the uh drive serial number which is like more or less unique. So you can use that to further pivot in this case give you a lot more other samples related to the same machine where this file was created. And again we can see what it's doing basically in this row.

It's pretty long but just what's just doing is running Pearl against three files hosted under the same GitHub repository by the same user downloading and executing them. And we can see it's executing a PDF that's downloading some other file and so on. We'll take a look at that now. So three files again. We have a PDF. We have a file called runtime broker.exe which is actually legitimate file. It's not mware. It's not modified not not chosenized nothing. And we have our third file which is going to be the most interesting here which is called umpdc.dll which in case you might know there's also legitimate file called like that but in this case not legitimate. And we

will see the reason why exactly we have this legit file, this mo file here in a second. And also take a look at the decoy on the left because the decoy is really important and gives you better understanding who exactly the victims are and who the victims are which are targeted. And again important thing all of them are hosted on the same GitHub repository. So again if you have a GitHub repository by a threat lector always go there and look at the other files being there. So the really important file here, this umpdc.dll, which is actually not the real UMPDC.L, but instead a um info stealer um was uploaded to GitHub. So we can download

it, but you can also download from uh sorry by total download from GitHub. And we have another time stamp here, which is the 5th June, which is important date because this campaign was happening in the beginning of June. It was going on until I think the 19th June. So that's like one sample uh delivered in the beginning of this campaign. And again here this compilation time stamp it's from the binary itself can be modified but again not everybody is modifying that. So if you do such research and you have some PE executables so DLS exe files take a look at these timestamps. Sometimes they are forged but sometimes they're pretty obviously forged so you know not to use it. And now is the

important part because why this legitimate file was here this runtime broker.exe because what exactly uh especially was happening here is something called DL site loading. So in case you don't know DL site loading is a technique uh for binary proxy execution where you can run your mo through a legitimate file. So basically in this case that's a screenshot from hijack lips which contains an entry of all DL siteable DLS basically tells you like in this row if you have your legitimate runtime broker.exe and your mware in the same directory with the named CDL it will be run if you run the runtime broker.exe. So that's really nice for use of thread vector. You don't need to

run your mware by yourself but can run legitimate file which runs the mo for you which makes detection bit harder. So some techniques for like obiscating your traces and this DL again is info stealer. So we saw in the previous talk 100 ways to find predators in under no finding 100 ft in under an hour. What exactly info steelers are what they are targeting and stealing. So not go too much in in depth here what exactly infos stealer is but just to summarize it's a type of malware which collects sensible files from the system and exfiltrates them like passwords like cookies like files for password.txt txt stuff like that VPN configs and other things and in this

case was exfiltrating stuff to telegram. So basically was using the API of telegram with a bot user which was hidden in a encrypted config and using this config uh it retrieved the bot key bot channel stuff like that and also what files extract exfiltrated to uh telegram and we call this pa stealer. The reason why is because the guy was using a username paza. It's an Iranian word for I think pure devout something like that. So just to give it a name because why not? So um going back to the GitHub. So I said um all these files were hosted in GitHub. So it's really important that you go on GitHub and do some further

pivoting there because want to find new more files because we know already three files have been there. Maybe it was four, maybe five. We don't know. And what you can do is you can just clone this repository because one important thing here is as you can see here we have some edit files uh like lines and we have some removed files which means there was stuff not present anymore. But if you know git we can just get clone and then maybe check out another um commit hash and retrieve those deleted files which is really amazing. And using that we could recover like I think 30 files whatever uh also a lot of old files because as you can see here also

this repository was created in December end of December last year and was active until roughly end of June so when this campaign ended and the user was uh blocked and the repository was deleted um we don't know exactly when but uh more or less end of June and also really important so if you look at commits um some Commits may contain an email and a time zone of the person using the commit. And we can just look at it, maybe find out something new. In this case, we saw a proton email address. And we see a time zone offset of plus 3:30, which is the default Iranian time. So, we get some first clues about our threat

actor like maybe where is he sitting, maybe who's targeting. And also one important thing if you have like a proton email address um proton has a PGP key assigned to your email address and you can look up the creation time of this PGP key. The creation time does not imply that the account was created the same day because you can recreate your PGP key but it gives like a lower bound. So again some time frames you can use to like narrow it all down. So keep in mind again if you have like a malicious G repository clone it get all the files because if you clone it and they delete it you don't really care but you get all

this juicy bits of information which you can use for your research which is really amazing. Next um yeah so like I said a lot of files been deleted but we tried to get them all and also like doing some pivoting. So basically looking for similar files on especially virus total we could also find another repository called files 2. So the other one was called fires my files too pretty clever and by the same user and using all these files there have been a lot of different files which is really nice because you can analyze those files you can write yara roots you can use like characteristics of these files and go to your platform of choice like virus total

and just hunt for more similar files. you can use PDP key uh PDP key uh paths in your executable stuff like that and using that you can create like a lot of connections and find out a lot more about the threat vector and I'll show that in a second. So again as I said so was the lead we saw it was lead on 25th June so end of June when the campaign ended last time we check on was the 20th 20th June. All right, the campaign. So, we got some files, we got some moreware, we got some stuff to play around. We got some PDFs, we got some executables, we got some I don't know, whatever. Uh, let's analyze

it and see what we came up with. So, again, search for all this uh case uh for all these fat related stuff. We found a lot of files, a lot of things that belong together and we have this campaign. So again, this campaign I showed at the beginning with an LK file pulling a PDF and this PDC DL and the runtime broker that was like this Iran opas migr. But we also saw this threat actor was trying out new stuff, experimenting, trying out new malware, developing stuff that didn't work, stuff that did work and we can find all of this using pivoting. So basically cloning his repository looking his files searching for more files always pivot pivot pivot

and I will try to try to show you a bit more the files related to this campaign because in total was like over 300 files and not go too much in depth into into each uh file and stuff but this campaign to summarize in one word one sentence basically is this last line. So it was only there to deploy this information stealer targeting again Iranian dissident and activists and experts. There was no back door. There was no persistent access, nothing. Just deploy this puzzle stealer, get some information out back to this guy who was presumably sitting in Iran and then use information for espionage presumably. And just to give you an overview of what a few weeks of pivoting can look like.

So basically while I was working on that, I developed my own tool to like track all these connections. So these things so these um uh circles are files and these squares are network indicators like in my case telegram endpoints because again telegram was used for exfiltration but also GitHub repositories from where stuff was downloaded temp files uh files hosting temp files and other sources and basically this is like the campaign you can see all the interconnected files because they belong together because they shared some indicators uh which relate them to each other because they use the same network indicators and stuff like that. So basically once we start like getting into it doing some pivots we can see like a lot of files

belonging together. For example we have here in the middle like a big telegram cluster. So basically we have all these files which point to this cluster uh excluded data to that. And so basically what we can look for is just go and look for all files communicating with a telegram endpoint and we get all these other files. So there's a lot of stuff to keep in mind when doing some research. Uh you start small, you try to get big, but it's really important that you just just keep in mind what actually relates to each other because sometimes you have stuff with high confidence uh because again you have really unique stuff like this um telegram endpoint for

example and you know okay if there's other files communicating with this telegram endpoint it's probably related but there also weak indicators like file names for example which is easily forgeable. So always when you do such research keep in mind that is it like high confidence is it low confidence is it medium confidence and try to separate a little bit. Don't just throw everything into the pot and all these other stuff around here. So which is basically all the stuff not in this uh red big square uh is like testing stuff. So we can see a lot of other files a lot of other network uh indicators and most of these files were like experial builds

just trying out new stuff. And this threat actor was especially interested in developing loaders and droppers. So basically a piece of mware which just downloads and executes another piece of malware basically to have like execution chain and not have everything in the first stage. um he was trying stuff in C++ and Rust in Nim whatever but didn't really work and was all abandoned but still we can all find the things and just put it all in a timeline and like understand how like such research is going on and like the malicious minds and just to understand a bit more and al like get out some intel which you can use on our own for like instant response

threat intelligence sharing indicators stuff like that. Um, so we still don't really know what the initial delivery vector was. So how exactly the threat was delivering all his files to to the victim. So like this LNK file for example, presumably email, I think that's the most u uh thing with the highest um uh probability, but we are not 100% sure because we just don't know it. But what was always the same was like basically execution chain that happened once you ran this malicious LNK file which looks like this. So basically we have four different kinds of execution chains and all of these are not too novel not too too advanced I would call it but they're like pretty

basic. So if you work in a sock, if you work like on the blue side uh side of things, if you do like threat um detection engineering, stuff like that, these are things you should have on your radar, things you should be able to detect. So we have like this first line, which is the thing we saw at the very beginning. So we have an LNK file which runs some other tools to download some further payloads. So like pearl, ser util, bits, admin, so living off the land binaries and scripts just to blend in like normal traffic stuff like that. And at the beginning everything was hosted in GitHub was dropped was executed. Now again GitHub is pretty

nice because GitHub is a living on the lands trusted sites kind of thing. So people use GitHub a lot legitimately but you can like abuse it. So you can't just say oh yeah traffic to GitHub is bad like that's like the thing that this pack is abusing like this reliance and trust on trusted things. as well at the end of the day. Um, also another thing where the LNK file itself does not download directly but instead drops something else which then downloads. So you have like a longer chain. So in this case the link file does not run curl but drops a hta or bet file which then runs curl for example. So you have another

chain process chain for for detection. And one thing which is pretty easily detectable is we just put everything into a link file. So you don't need to download anything. you have no network indicators in that sense. Just put everything to a length file. You then carve it out. You drop it. You decrypt it with X or whatever and then you run it or just put everything in an archive. But again, all these execution chains uh will be different at the end all deployed uh PDC.dl. So paser uh always being sideloaded by runtime broker.exe. So we have this legitimate chain of like execution which then in turn did some data exfiltration and also one important thing. So even

though the campaign ended there was still development done there's still development done to this day. So last few weeks were bit quiet but still some stuff happening so I'm still tracking it. So maybe it's going to be part two I don't know. Uh but also one important thing for like again detection engineers here if there's someone I don't know. Um you can also just replace the call from link to cmd or powershell with PCA lure or other low bins. So you again disrupt this process chain. So keep that in mind when you develop use case that you can alter this chain of execution to make detection a bit harder. All right, the lurs uh which I think is

the most interesting part of this campaign. Um so in this Iran opposed medium campaign itself one PDF was used the one we talked about the very beginning that we'll talk about more bit more in depth but there have been some other lurs used in other campaigns some other test lurs which probably were not used but again show just some experimentation and some development effort uh which is again really nice to know um and of course these testing things were not really rundated because we're just there for testing. So we have our first and most important lur which was created on the 9th June. Again that's a metadata piece of information can be altered but it fits the general

chronological uh development. So I would say that's probably a correct time stamp. And basically this lur used uh that was used was trying to abuse the trust in this campaign called rise Iran which is like a legitimate campaign uh run by Prince Rza Pahaba. I'm not sure if I'm pronounced correctly but basically against the regime in Iran. So basically it was a goal to use abuse this trust in this campaign and the lure looks like this on left. So you can see it's well not in English it's in FY but you can see on the right translated by AI which actually made a mistake really important. So I used a guy I know who knows Fzy to correct it. So don't always

trust your AI translator. But that's basically the lure use. So basically when you run this LK at the beginning that's the thing it's going to pop up and if you see this and you expect to see something similar you won't be like suspicious that maybe something else is running in background. So that's like the lur used to just give you the trust that hey you want to open this PDF like it was actually Len K but here's the PDF like you're fine there's nothing happening in background and was basically invitation to a meeting with this um rice I ran campaign and interestingly while it was an invitation to a meeting there's like no URL no meeting ID nothing there so there's

like no real meeting it's just like alert to say hey come to a meeting but well there's no meeting and you can see also here the date of this meeting is the 9th 19th June which was the end of this campaign. basically was starting on 9th June and going to the 19th June and then using now I get pivoting because while pivoting we find out that the guy actually uses the username pasa which is again a Iranian word for uh I think pure and develop or something like that and you can just use like and look for files being created by such a username just go to to to various or whatever and you can

see here for example so I have an excel spreadsheet which was modified by pasa and that alone is not a big indicator because par itself is pretty generic word. So don't just use this as like pivot and say yeah sure that's created by him by the same thread actor but instead also look for other indicators which might prove your point and in this case uh it was pretty easy to prove my point because it was also runningtime broker.exe exe. So the legitimate file we already know and then was running. So it was also placing the UPMC DL in the same directory in this assets directory and then running it. But this was like a testing kind of thing because I had no

real GUI. So it was like no data in it. You can see here that was empty. So it's a test file just testing out different things see what works and so on. Um again some testing files. Not going to talk too much about that but just testing out different things. So we had an Excel sheet. Now we have a worksheet. So like typical things um stuff you don't see too much around anymore because the security of such microbased things got pretty good. Um so that's not really too workable anymore. It's still used but just like not in the broad anymore. Um again some I'm just going to skip it because also like a test lure but one

other interesting lure was a ISO file. So an archive uh which again was created by our PA user. You can see here in that bottle the host name now para PC which was later confirmed to be actually um host name and it's basically when you run it inside this ISO you open again our runtime broken back end and so on but we have this kind this time another lure I'm just also going to skip that uh with some a lot of names with some military and police related names so again this file this um initial file Yeah, it's called person personnel. So you expect to see some personal details I would say which would fit here the

narrative. It's all written fy. Um I did not confirm who these people are. So I don't know if these names are really legit or just thought out maybe AI generated. I don't know. But also like if you go a bit deeper you can see also a lot of images just from the same um lur. So just to create this trust in yes there's no mobile running in the background. you got what you're looking for. So just trust the process more or less. And again, test file. Going to skip that. And that's in my opinion the most funny L I've ever seen. It's called wall.jpeg. And I found it from the commit history. So basically was deleted. So it was

uploaded three times to GitHub repository, deleted three times. And you can see like this repo with a scythe and you have this text, your files been encrypted and your important data are stolen. Read the readme.txt and follow the instructions. Now I have 300 files or so by this threat actor and not a single file has the capabilities of encryption. So like what's going on here? Like what are you talking about? But there are some files called written.txt which are in fact info stealers. So my assumption low confidence. It's just like kind of social engineering like scaring you into saying yay assistance encrypted open this file and then you just run this info stealer and basically nothing

happens from your site because your files are not encrypted. But to make it even funnier, um, so seeing this logo, you might think that our Fred has some kind of artistic abilities. Um, actually not. It's stolen from Shutter Stock. Um, not sure if you bought it for €29 a month or just copyright infinit, but yeah. So sadly, um, sadly for that. So let's look at the malware and not going to spend too much time here because I'm not don't want to go too much into the depth like reverse engineering stuff like that because also it's rust and rust is a pain in the ass to reverse engineer. Don't quote that please but just like give you like a

general overview what's doing how it look like stuff like that. So again uh we have some other abandoned stuff and this is like the most important thing in this whole campaign. So it's like uh worth file to look at at it and also there was still developed even after the campaign was ended on 19th June. So there was still some improvements being made which would be interesting. So presumably it will be used again. Maybe maybe not. I don't know but why else would you then continue to improve it? Um just like a really small overview what's stealing. It's like generic stuff more or less the stuff you would see in like all kinds of info steelers. You

have like all the credentials type of things, your crypto wall is really interesting. SSH keys to maybe then access the system later on, VPN configurations and so on. There is no like Iran specific stuff being stolen. U but honestly also I have no idea what that would look like. Um in total I think the config contain 500 lines or 300 lines of things to exfiltrate. Um, I have a GitHub repository where it's all written down. So, don't want to spend time reading 300 lines of codes. But the really interesting part is there were a lot of debug strings left behind. So, when you compile your binaries, you can strip them, remove some uh important things from there. But in our case, our

guy did not. And you have some build paths. So, basically where some custom libraries are contained. In this case, we can see again our name pasa, which we already seen quite a few times. Now you know why. So now you know why it's called pasa stealer. I hope so at least. And you can see just by looking at these strings, you don't really need to reverse engineer it just to understand what it's doing. So basically if you just run strings, you find for example the string and you find at the end this string abcrypt. And if you're maybe familiar bit with info steelers and just general like security what's going on right now, you might think ah yeah it's

probably stands for appbound encryption which is the mechanism used by chrome and chromium based browsers to protect your credentials. uh because your credentials are like on disk. So it's being protected but you can bypass it using some uh libraries and in this case uh it used a library to bypass it called Chrome app bound encryption decryption which is open source on GitHub. You can just pull a DL loaded reflectively into your Chrome browser or process and you get all your credentials. Um so the guy was like at least knowing in bits what he was doing. Um so that's not uh not every info dealer has it but if you're like a bit more mature you

have like this support for this feature and exfiltration again also pretty interesting part was always happening by telegram again telegram is kind of like a legitimate destination it's not like more minus exfiltration.com whatever because that would be pretty obvious telegram is a bit more hideous I would say it's also a bit more offiscated but you need to way to communicate with telegram so basically if you are the mware there and you want to send stuff there, you need like some credentials to access it and you need a bot ID, a bot token and a chat ID and all of these things are contained in a mway itself because it needs to use them. It's just

encrypted in the config but again it's like decrypted at runtime. So we also decrypt it and retrieve these things and then we get like all those different Telegram channels being used. So it's one channel. Uh actually it's just different bots using this channel to exploitate data. And the really cool thing is we can just take all these channels. We can take all these samples we have uh because for the samples we know roughly when they're being used and just put it all like in a timeline. It's like the stuff you see here on the right where you just assign like a period of usage to each telegram channel to gives like uh some more information about like

the chronological development of all of it and also like the total samples used uh in this campaign or like by this thread vector and I could have done animation here but I was a bit lazy so I will just have some slides covering it. So basically going from top from bottom to top and it all started in like December 2025. So basically our threat started doing threat actor things in December 2025 and back then he was still quite normal quite new to the game uh trying out different things. Actually at the beginning he already had an info stealer called Reaper Stealer right remember the Reaper with the scythe thing. So that's like his well theme his way to go I

don't know. And he was using like a really simple Reaper stealer probably developed inhouse because I did not find any open source reference to it and also like something called crypto watcher which was basically clip clipboard monitoring tool to detect whenever you have like a cryptocurrency uh key in your crypto wallet and exfiltrated to telegram. So things started easily then in late uh December 25 an interest in rust apparently arose. I don't know why but it switched from go to rust. It was still the same infos stealer, same semantics, everything was the same was just developed in rust and then we started to get more mature. So basically in January February 226 of this year things start get more mature

the development continued was improved new paths were added encrypted config was added stuff like that. So that's like really the time where the fret was like let's go let's develop some stuff and then we had our June campaign. So we still had some development from February till till July but that was like the time when this more mature version was used. So we can see like at the end of the day thread actors are also software developments software developers uh can start really easily but it can get pretty complicated at the end. And one interesting thing also as you can see here you can see two different bot IDs. So the value on the left but you can see

it's using the same uh bot key which to my understanding is not possible. So, which means it has been error and one of these two lines did not work. I assume the second one, but I'm not sure. Sloppy fingers. I don't know AI up. I don't know. But yeah. And now because we have all these data, so we can like just pretend that we are bot ourselves. We can just go to Telegram just connect to it. This case using Telegraer open source tool to get some Telegram information. Just connect to it and see what we get back. Sadly for us, we couldn't do too much. We could just some data back. We can't write messages,

anything like that. But we again get our Reaper theme back. Reaper data bot in this case was the username of our bot. And we get some values back. And if you remember, Anon user was also the username on GitHub. So things closing back. So the circle like closes. We can't do too much here sadly. Would be really nice to just spam the channel and download stuff. But yeah, you're not always lucky in life. Um just like really quickly because I was speaking for too long already. Um as I said like there was a lot of development effort putting into this information stealer and I tried to like cluster it by generations. So basically whenever like

a big leaf in functionality changes just to give it its own generation and you can see like roughly by month all those different generations and how it changed. So basically start development on Windows, switch to Linux, use different con uh encryption schemes for the config and then generation two basically in June when the campaign started also support for Firefox's key4 NSS was added. So the crypt Firefox based credentials and also then the Chrome application bound encryption uh decryption was then added and one really interesting thing is so basically this AP uh decryption that's a open source library being used and in the beginning it was embedded in the sample itself. So basically sample ran dropped it ran got

the credentials and that's it. But in July or end of June July uh it was changed and the s this this uh AB decryption was no longer present in sample but hosted on another server for downloading and this case was hosted at curl minus t.com which is also like a living off trusted sites kind of thing. It's basically like a file service made for curl. You can upload stuff, you can download stuff. it's publicly available and in theory if you would have all the web access logs from this service you could correlated and find out who the victims are in theory again I shared this research with like the local authorities maybe they're trying to I don't know but

it's a um Netherland based uh company it's not German based easier but fingers crossed who knows and again like expert paths 300 something um And last point, object failures. Um, I was saying in the beginning that I downloaded the whole GitHub repository, so we also have files being deleted. And for whatever reason, our guy just uploaded some Progma logs. So in case you don't know, Progma's process monitoring. It's a tool from tunnels, which is like kind of kind of officially Microsoft tooling, but not officially. And um you can use it to to to see like what's happening on system like process run, registry access, network access, whatever. You can use it for like debugging your your binaries just to see

what's going on. And our guy was apparently debugging some stuff with Promon and just upload it to GitHub and then deleted it, which is nice, but it's still in the commit history so we can download it. And we can find out uh was well, he's just trying stuff out. You can see like on the 6th and 7th February, so before roughly before the start of mature puzzle builder builds, puzzle steer builds, he was trying out how to do actual DL site loading because before that it was just an EXE run as an EXE, but it changed to being a DL being sideloaded. So you need to try out how it works. You tried like different DLS,

you tried out different exes to run your sample and it didn't work at the beginning then it worked but then he decided to use uh runtime broker and uh UPMC uh DL so interesting thing also using these procon uh logs we see some more information again our username pasa which we know we have like again the username we have like the host name parasa PC which is already known but now we have like another source of confirmation for our assumptions because again like low confidence high confidence. Think about that. So, if you have more sources to back up your claim, that's good. Also, we have all the environment variables inside the first line of the Promon uh log. We can see

stuff where you know, like we have some cargo being used because it's ding rust. That's fine. And but we have some UPX uh being used. That's a packer in case you not know, which is also used by other files. And we also have like donut which is a shell code generation tool which is also used uh by spread and like some testing things but we just get more and more information and also like just for development apparently use conu and and scoop for like binary uh or like for some environment variable which is also interesting but yeah not very usable and yeah it's the same way uh same thing I talked about and just like a quick

summary so basically what you can learn about our nice guy so we have again a time zone offset we have some email addresses some names But that's really important thing to point out here at the bottom. So basically all these values we have they can be modified. They're like attacker controlled because this offset in git in commit history can basically you could choose whatever you want. The same with the email address and all these others are like attacker controlled at the end of the day. So you can assume that he changed it all to like lay a decoy. You can think about he just doesn't know what he's doing. So it's like kind of bit up to interpretation. But never just

assume things because you see them. So yeah, and attribution last thing just quickly. Um long story short, I don't know like honestly I have no idea. Um there are some um there are some things we have. So the things I just showed and basically if you connect it to some other researchers, we have some campaigns which are similar but there's nothing well I would say like that's definitely the same guy. It's definitely same group. Whatever. It's not enough evidences there. So in case you are doing fetch, you know a bit more, call me uh like would like to exchange stuff and ideas. But there's like no blog post or research I found publicly which would

be definitely the same guy as in this kind of research and yeah again just like quick summary uh using a lot of living interested sites. So that's like really pain in the ass for for researchers because you can't just attribute it directly. You don't have like really certificates which can use to further pivot or some registrations domain registration stuff like that. So that's really bad. But if a flat knows what he's doing that's like the way to go for him. So that's also really important thing again for the blue side um blue side of things. If you're doing like detection and sock analysis, keep an eye out for these things because it could look legitimate

but maybe it's not. And some final words, just the same thing as I repeated. And yeah, thank you very much. Um, if you want to drinks, hit me up. Uh, if you want to read something, just read the blog post. And thank you very much. Thank you very much. It's time for some questions now. Um, does anybody have any questions? We have a mic there now. Uh, yes, I can see your hand. and the microphone will be traveling to you. Yeah.

>> Thanks a lot for the presentation. I have a question about the the browser uh like stealing credentials from the browser. >> Yeah. >> Why threat actors are doing it in the computer itself rather than hacking all the imported bits and pieces and sending it to themselves to decrypt it? Uh, I don't know exactly. I would assume it's not that easily possible would be my assumption, but I'm not too much familiar actually with how AB works. So, I would rather not answer the question. Sorry. >> Yeah. >> So, not too familiar with that. >> That would add probably too much to the behavior chain and uh any malware detection or something can easily get suspicious.

>> Yeah, I I would assume it's probably related to maybe that the secrets are stored in TPM while it's running. Something like that would be my assumption right now, but honestly, I don't know. >> Yeah, thank you. >> But I'll look it up. Thank you for the question. >> Okay, any more questions? Anybody? Yep. In the back there. Yeah. >> Uh hello. Uh how did you decrypt the the parcel stealer? >> Um so by analyzing it. So I'm not sure where you're standing. Oh um but so basically analyzing because the key and and the encryption itself is in a binary itself because you need to decrypt itself at the runtime and I started looking at it and I saw like ah

that's some encryption being done because no paths really visible. So I'm being completely honest. I asked Claude to help me a bit and it worked really well. So I use for analysis a lot of AI and basically what was doing at the end was I was telling Claude to write me a decryption script and so I can like decrypt new samples by myself and also what worked quite well is in case you're doing some similar kind of research uh I was using GRA with a MCP server so basically connect your cloud instance to to GRA by MCP and just tell it like hey there is this encrypted blob at this address or found it manually but you can

maybe just tell it find it whatever and it works astonishly well. So I'm not a good reverse engineer. Would take me probably weeks to do so, but using AI was just a matter of minutes to be honest. So I was using a lot of AI this kind of research. >> Okay. Thank you. >> Thank you. Uh any more any more questions? Don't see any more hands. Maybe behind the where I can't see. No, looks like that's it. Yep. Thank you very much. >> Thank you. >> Thank you. >> Thank you for your presentation.