Hello and welcome to another practical in this practical, we are going to take a look at a simulated
malware written in Java and the file is here, both Java demo, which are so going down on this and
unzip it and put it on your desktop inside this folder, you will find in Java, in the Java, as I
mentioned before, he said Java archive consisting of multiple class files.
I got on my bike.
He was open.
So I'm going to open this jar file using my computer.
So click on file and.
And then open these wanya.
There's no booking on it and then click on the plus symbol here and.
Insanities, Jaffa, you can see there are multiple files, including one for the.
He's imitating folder containing some information and also dates and cost and I mean that, plus the
first thing you want to do is to detect, right, is to mean that the main method is where the program
execution starts.
So looking for the class, looking at the class name, this could be the class which might contain the
main method.
So you click on it and here you scroll down and you can see this is where the main method is form.
The main method always have the same signature.
Public static, void main together you say here this is string x array of elements containing the parameters
for the whole program.
So inside here you see that there are also some obfuscations.
Trying to make it difficult for the analyst.
So now you can see the E string, a hasty GPS and string B, string C and string UEA and strings that
and I hear the first function is.
So if you scroll down to VB, you can see it is creating an object by concatenating.
Three strings, A, B and C.
ABC, this three, one, two, three.
So what is he trying to do is trying to create a you are ill so we can defeat this anti analysis obfuscation
by trying to decode this.
You can see it on the screen as an equal sign indicating that this is an accurate basis for so we can
use any on line basis for only for this.
So just directly on this double click,
double click and select the Cosini to copy this in an open browser.
And then use Google to search for base64 to string.
Click on the first one, basically for the court or Haiji.
And the basis for encoded string here and the.
And we have discovered that you are.
So just copy this and put it in that.
Next, you go back and look at the next string.
Be suing on these over here these days.
So now we're looking to see see so here.
So we also copy this include equals copy this and we will remove this and paste a new string here and
click.
And now you're getting a name of the strain that has to be decoded, he copied a name you put here.
Now we go back to the court again and we have decoded ABC and you know that string a hasty TB's so we
can copy this.
And Paysite now.
In front.
So now if you combine three things together.
And these folks, they're here, if you look back at the core here, there's a former slash, we just
can't get any to anybody out of trees.
So we in our forests this year and immediately we get our indicator compromised.
So this is the father is trying to download.
So we go back to court here and we can see that he's creating this object in your arm and then which
is this is Hoti.
And then he is going to.
A hefty DPL connection object.
And after that, he's going to open a commission.
And then he's going to set a commission request again, using these diseases also, and this is before
you can confirm this, if we click on this.
See, the.
Yes, he's coming from here and see you click on this A from here, you can see the function inside
is basically for DeCota, not because this is not a confirmation that it is using base64, including
something here in C deck.
The day is the same function here.
So this also basically for this.
So if you want that, you can do the same thing.
You can copy the existing easy variable all over you and then go to decoding, but leave it to you as
an exercise.
So now we know enough about what he's trying to do.
It is trying to reach out to the command and control server and download the file.
And then if the connection, response to hunger that Mr. Farr managed to download is going to do this,
you.
The connection is fierce.
He is going to return the program.
So after downloading the file, you open a buffer reader to read the input stream and then create a
string out of it.
And then here you assemble the string that you've written, the string.
So the string is written.
We're here and safe as the variable eighty nine zero Z, and in the next line we will split that string
based on the separator, the colon separator, and then you will check the first part in a second.
But in the first part of the string is C, and the second part is the one.
Then you execute the function, call a function is down here.
So in a function, you scroll down.
It is trying to create a screen capture.
We're here, and then after creating a screen capture, you is saving this local one.
And over here is trying to create a random name, a random integer.
And here is going to create a look of.
Two star.
To start a Philco extension GPG.
And this is updated from the.
Integer high here, which is a random number and over here is going to write to death for the local
fire.
The local object, one means, is going to store the captured desktop image.
The screen capture into a look of which is the name Dungee RPG.
So this is your mother artifact.
You can actually trace this far it is in a 10 directory for your operating system.
So from this analysis, we already know so much about what happened when this simulated malware is trying
to do.
We were able to defeat is and the analysis obfuscation.
We managed to also find the indicator of compromise and also the malware artifact.
So this is how you can use reverse engineering to help us do malware analysis on Java binaries.
Thank you for watching.
I'll see you in the next one.