Samplepedia-Python Malware Sample Analysis

What is required ?

We are given only one file and by uploading the file to DIE :

The file is compiled Python bytecode. There are many available tools to decompile Python bytecode and retrieve the original Python code, such as PyLingual (https://pylingual.io/).

here is part of the code :

I see a bunch of classes and some lines of module-Level Code :

Renaming it :

i will execute that for loop and then dump the resulting code before it is executed

I noticed that the classes in the code is not used at all, it is just junk code.

here is part of the dumped code:

analyzing it step by step:

1-

This code disables SSL certificate hostname validation and completely disables SSL certificate verification.

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

2-

2-1:

that code install cryptography library and import some modules from it

2-2:

the malware initialize a public key in pem format for later use

3-3:

two arrays are initialize with some names, we will see how it will be used later by the malware

3-

now we inspect that part of the code that includes the DGA.

a domain is generated by joining a random ascii string that has length between 4-8 chars followed by “.” + a name from the first array mentioned and a name from the second array + “.com”

example of the generated domain : “ixzvunda.crackingames.com”

now this domain is passed as argument to the msg function which we will explore.

4-

the function makes a dns lookup to check the domain existences first, if not found it proceed to check other domains.

If the domain is found and the dns record type is TXT:

1. we check if the first character is “.”.
2. the malware strips the “.” and decodes the Base64 data after it.
3. the first byte of that decoded data is used as an index number, and the rest of the data is stored in pkts under that index (to keep the chunks in the correct order).
4. all the ordered chunks in pkts are joined together into ms.
5. the first 128 bytes of ms are verified as an rsa signature against the rest of the data using the public key (checking that it was signed by the key, rather than doing a simple comparison).
6. if the signature is valid, the data after byte 128 (the malicious payload) is returned from the function.

after that, the returned payload is executed.