Hello and welcome to this let walk through for the exercise, which I've already given you to do in
the previous video.
So this is a file which you have downloaded in a zip inside you find the cross java.
So that is opening you by viewer.
So click on file on air.
And then select the cross ranger file and hopefully expand on the contents of the jar file to see what
is contained in it, and you find out, one, two, three, one, two, three, four packages between
package B cross-bred Angurugu.
One of the first things we normally do is to look for the main the entry point, because that is the
main function, which is start whenever the job is done, run.
So to have us look for the main, we can use the plugin.
So click on plugins here and select the show minutes and they will tell you that the main method to
find two packages to cross package and the Ogi Janita, a sample package.
And from these two here, Janete is something similar to what we did in the previous video where he
was keyboard gilger.
So this probably is not the main.
This is the main.
So let's open cross-bred, find me so good across array and look for the client class.
Click on it for the decompiled.
One of the important skills of our member analysts is to look at the high level picture, no need to
go into every single line of code, but try to look at a high level view of what the malware is trying
to do.
So, for example, over here, we can see that there's a string here.
We here trying to look for a temporary directory inside the operating system.
And then if you look at a next line like UniFi, you will see it is trying to create a location, get
class protection.
The source code location bar is actually trying to get the string path for the location of the current
jar file.
Now, one of the common things that every member will try to do is trying to relocate to a new directory
or new path after he has infected the system.
And this is what he may be trying to do, look for a temporary directory and then look for the current
directory and probably copy it out to the temp directory or maybe some other party.
Even all of this is part of his trying to get persistance on the operating system.
A persistance means that he is trying to survive a reboot or a logger and login so that whenever the
operating system is reboot, locking the malware is can be sure of being able to restart again.
That is the meaning of persistence for all of these.
Enumeration is merely part of the effort to gain persistence.
Coming down the line, turning nine, you will find if elusive statements and you can see here it is
trying to create a path to a user's home directory.
And in here, this appears to be a Windows bar because of the two backslash.
And this one appears to be a Mac OS bar and this one a possible enough spot.
So what the malware is trying to do is trying to process itself by first determining which path is suitable
based on the operating system.
And then in 98 is connected in the past decade, killed key to a far many, many years, which are probably
deceased, relocated file for the malware itself.
So this gives us a very good, clear indication of compromise.
If you can find this file in any of these locations, depending on your operating system, then it is
a clear case of an indicator of compromise.
Now, if you scroll down further to line 77, you will find gate property or name gate property or some
version user name, as well as the Internet address, IP address.
So it appears that the malware is trying to fingerprint the victim's machine.
So probably sending this data on down here to command and control server.
And then if you go down to this line over here, a socket is being created to connect to the Internet
with the parameters killer B and C. So let us take a look at this, Klasky to see what's inside here.
So if you click on Klasky, you will see in scroll down.
Care to be flexible, Dot, common courtesy is a pot to to to treat.
So now we know that this malware is trying to connect to a command and control node.
And this you are Al Belgacom airport to two to three.
So let's get back to our main here.
And you can see that is happening down here.
And like 89, he's opening a data stream to the complex, very dot com and sending some data.
And what is it sending?
It is sending via one wire to wire three, along with some other data.
So far, Vanuatu and so on are coming from here with named shouldn't user name as well as the IP address
hostname.
So this will allow you to use this information, this indicator of compromise to update your organization's
network or intrusion detection or firewall system to detect or block this YAHEL and also to locate the
running machines in your organization has already been compromised.
And if you go to further, you will see that it is reading return something from the command and control
server and then this thing gets back from LA five here.
It is going to pass it and see what is the what are you supposed to do.
So as you can see here, based on the response it gets Gaspé you various other commands.
So now our remote access to is being used by command and control is not in order for some kind of remote
access control.
And if you want, you can go on further to explore the entire functionality for this remote access to.
And there are other things as well.
You can go ahead and look.
But suffice it to say that we've already found the malware artifacts as well as the indicators of COMPRIS
for our purpose for this video.
So go ahead and exploit for the evil.
Thank you for watching.