This article shows how to circumvent anti-analysis techniques from GootLoader malware while using Node.js debugging in Visual Studio Code.
In our debugging endeavor for GootLoader files, we use a Windows host with Node.js JavaScript runtime and Visual Studio Code installed.
By employing Node.js and Visual Studio Code, we can step through the JavaScript file's execution, set breakpoints in the code and use the immediate window to evaluate expressions.
As an obfuscation technique, the authors of GootLoader have interwoven lines of GootLoader code among legitimate JavaScript library code.
Throughout our debugging process, we observed the code execution that appeared to be seemingly stuck within the confines of a particular loop.
Below, Figure 2 shows a snippet of code from one of these loops.
To gain a better understanding of these loops, let's delve into the surrounding code from the loop in Figure 2.
Below, Figure 3 shows an isolated rendition of the original code that we will focus on.
In Figure 3, the while function within the code causes an infinite loop, because the variable jobcv is consistently assigned the value 1.
The successful execution of this line relies on the function array horsqe7 pointing to an actual function.
The loop persists until the counter oftenfs reaches the value 2597242, at which the function array horsqe7 references the sleepy function.
Inside the sleepy function, we observed a familiar function array name from Figure 3.
Code execution will land inside the indicate6 function.
Again with more delays, code execution will reach the course83 function shown below in Figure 6.
The function course83 is where the actual malicious code begins execution.
Finally, debugging the course83 function unveils and deobfuscates JavaScript code that initiates GootLoader's malicious functions.
Below, Figure 7 shows a section of the deobfuscated malicious GootLoader code.
The creators of GootLoader employed time-consuming while loops with arrays of functions to deliberately delay the execution of malicious code.
Table 1 lists the counter values and their assigned functions in the order they were called from the GootLoader JavaScript code.
Counter values and their assigned functions from the GootLoader sample.
This Cyber News was published on unit42.paloaltonetworks.com. Publication date: Wed, 03 Jul 2024 22:13:05 +0000