Hello in this, that you are going to try to reverse engineer and not a simulated melee, so I'm going
down this fall and I zip it and put it on your desktop inside and you will find the Philco Ranger.
So fire your back.
You were.
And then use them back if you were to open the file.
Click on the plus to spin.
You will notice the many other files within this Ja'far, so there's a package called Congregated,
right?
He signed this Ja'far, which contains another jar.
There's also another package here inside the jar in mummification.
So at least three packages, including one Jaffa.
So let's try to look for the mean setting for this jar.
You can click on Resources Resource, the.
If they come back and begin here, you will find yourself standing here.
So this is where program execution is set for this Java on top here.
You see that there are many strengths, but they are being named in such a way as to confuse the analyst.
The author tries to make it difficult to analyze it, to create unnecessary strings, unnecessary variables.
And we can check.
Selecting one of these copy and do a search party, Contrave, a search to see how many times this is
used in this program, and you will find it is only be used once over here and you find the same thing
for all the rest as well.
So all these are just junk variables which are put in to confuse the analysis.
And if you scroll down, you will see the same thing for these split spaces is also used new once and
nowhere else in this program.
So speciesist is also used to divert the analysts attention and to delay the analysis process so we
can ignore this.
The only thing we need to focus on is he mean it's taking me.
So let's do that.
Now, the first instruction here is to create a.
And here again is another obfuscation, tiny.
It is trying to combine multiple components together to create a string.
And it is trying to do that by referencing members of various classes, the G class glass, the G g
dress SDF class.
So all this crosses Jr. and Gandhi just coming from here, so let's try to rebuild this while.
We are open so that we can try to use that back to rebuild the district, so the first part of the string
is due to see.
So Itliong, g, g, c, e string calling.
So we can write it down five.
Colin.
Coming back to me.
It is concatenated New Jersey G is not for recession.
So we put in the conversation here.
Coming back to PIN.
Jill, who is that is Dan Concatenating, we've got em, which is this guy, the M.
Which is X con.
Eggs for research come from research, come back to me, and that is concatenated degrease asdf NSX,
which is just one is class.
Don't know sex is rocket fire slash.
So we get Jay Rocket forward slash.
Come back to me and that in turn is concatenated.
And so let's look for DG Dunam, which is dry for research.
So it's been dry for research and this time.
He's concatenated big, dressed as the axe, so we come back to this class next, introspection, introspection,
Touya.
So we type in Drew speccing do.
Yeah, so this is a far, far off.
So the fact is he appears is referring to this other package which is embedded inside his jar.
So it seems like this program, this PSM zero Anjar.
Has got a backfire within it, which is disrespectful.
So when this program runs this resource, the runs, what it is effectively doing is it is trying to
open this fall this backfire.
And then you can see from here, after he has created a path to this fire, he is going to look it over
here, placeholder, and then he was going to create a threat, a new process, a new threat over here
to run this jafa.
And then it is going to open a method within that far from here, you can see see that gay men.
Right, so now you have to take this far and look for the men, because here he's referencing me and
he's going to run Minamata in sight here.
So how do we unpack this to unpack it?
We come back to this Ja'far here and we used to zip program, 7C program to unpack it.
So this Reichling this and Asala 7c extractable zero one.
And now we have you back here.
Here.
So now we have to end this jafa to Bikel viewer so that we can trace the mean method inside it, because
the main method inside is what is being referred here.
Let's do that now.
So to Edgar Jafa.
There we are.
Just unpack Itliong file, click on ADD and then navigate to this location.
And bring on it to select and Jaffa and click open.
So now we can analyze it.
Just click on the plus icon, click on Add to Cart to Decompiled.
All right, so now we look for I mean, so this is the mean, so it is this party which is going to
execute over here.
So you get me Engvall.
OK, so let's go back and analyze what does it do?
So the first thing it does is.
He creates a neti hook, we obviously register native hook after a native who.
Is going to over here at Keely's, and that means he's a key logger.
Looking at it so it is a killer out of this class, new introspection to its constructor.
Nu is a Kiwi in Java to call a constructor.
So this is a constructor for this class and so the constructor is over here.
A class name is intermeshing to the constructor here.
So what it does is it creates a team directory.
And create a new file within that 10 day tree of your operating system and Java deployed log.
It's the very is if it doesn't exist, he's going to create a new file.
So this is your Melva artifact.
So what is he going to do here?
Most probably is going to lock your keystrokes into this file.
As you can see here, it is creating a firefighter.
And you're here because you are registering.
Key press, a native Krsna, so the native Krsna is this this is a handler for the keepers, so whenever
they use it to say anything on the keyboard, it will trigger this.
Keely's in a key presence in there and it is going to get a keystroke whatever to use it and try to
include it.
We are encoding.
So this is a symbol for Xolo encoding.
So is going to include encode if the number one five one so that even if you were to retrieve Jowhar,
deploy that law in your favor system, you won't be able to really because it is not in plain text,
it has to be encrypted.
So ah so are one five one.
So now you have your evidence of an indicator of compromise.
If you can find this far, then data indicate a compromise and you can actually decrypted by Larrivee
one five one.
All right.
So this is how you can use a Bikel viewer and then like a reverse engineer, unpack a fact file and
then decode it using analysis, as we have just done.
So I hope this was useful to you.
Thank you for watching.