{ "schema_version": 1, "report": "J@IL-GPT: the malware inside the jailbreak", "research_date": "2026-09-06", "collection": "Public forum and GitHub artifacts; not Mirage inbound telemetry", "method": "Static parsing, disassembly, decompilation and offline byte transformation; no suspect executable was run and no extracted command-and-control destination was contacted", "repository": { "name": "kikus662zqdz/j-ilgpt", "head_commit": "d23920785624dfa20077b4a20bb144d0d251032f", "release_tag_commit": "b26af916550c289ea27e4101594e7c59bd576035", "release_published_utc": "2026-03-29T14:06:02Z", "release_exe_downloads_at_snapshot": 11, "download_count_caveat": "Not executions, unique users or victims" }, "forum": { "thread_id": 71430, "post_id": 423476, "displayed_author": "yahyawrt", "displayed_timestamp": "27-03-26 08:29PM", "timezone": "Unlabeled; not converted to UTC", "linked_repository_path": "github.com/kikus662zqdz/j-ilgpt/tree/main", "scope": "One verified public thread; identities and successful infections not established" }, "artifacts": [ { "artifact": "historical_zip", "bytes": 3505994, "sha256": "a2537c5329b050d69e4113ce3267581f64249a3351353210c940f70bd39c108b", "parent_artifact": null, "source_revision": "378680a7eca95664a75907b79d55a9844d22ace7", "method": "Repository history" }, { "artifact": "historical_msi", "bytes": 7208960, "sha256": "597ee6ca1267fe50fe52b2a70257ce137ec94be55290e7be0e54ba436da03118", "parent_artifact": "historical_zip", "source_revision": "f81ff05c9160d33c77ffd708c300b3a4aefc0861", "method": "Repository history; identical MSI extracted from ZIP" }, { "artifact": "msi_embedded_loader", "bytes": 7135320, "sha256": "485f69d2d9515ad7d64382d8e986964815a6528f0c61ff62dce307690900c5d0", "parent_artifact": "historical_msi", "source_revision": null, "method": "MSI Binary table stream p", "pe": { "machine": "0x8664", "entry_rva": "0x2ba84", "preferred_image_base": "0x140000000", "sections": [ ".text", ".rdata", ".data", ".pdata", ".xdata", ".reloc" ], "authenticode_directory_size": 0 } }, { "artifact": "advertised_exe", "bytes": 7202239, "sha256": "056f5bdc2cb87c8d1290311cc9735e9104d45c6148021f5bd33857f5c14f523a", "parent_artifact": null, "source_revision": "d23920785624dfa20077b4a20bb144d0d251032f", "method": "Pinned repository; digest agrees with release metadata", "pe": { "machine": "0x8664", "entry_rva": "0x33ba4", "preferred_image_base": "0x140000000", "sections": [ ".text", ".rdata", ".data", ".edata", ".rsrc", ".reloc" ], "authenticode_directory_size": 0 } }, { "artifact": "inner_from_exe", "bytes": 2662400, "sha256": "e395fd44a750ccc4da5740d83645fda7b2cdc0bb9de3fd6e8cbfba7ac90c3feb", "parent_artifact": "advertised_exe", "source_revision": null, "method": "Offline arithmetic reconstruction", "pe": { "machine": "0x8664", "entry_rva": "0xdcc4c", "preferred_image_base": "0x140000000", "sections": [ ".text", ".rdata", ".data", ".pdata", ".reloc" ], "authenticode_directory_size": 0 } }, { "artifact": "inner_from_msi", "bytes": 2662400, "sha256": "f8dfd1e44ad3acd3e7fd0cff6cb0f02f0c2e88ebbc363990c22517f78a0c0011", "parent_artifact": "msi_embedded_loader", "source_revision": null, "method": "Offline arithmetic reconstruction", "pe": { "machine": "0x8664", "entry_rva": "0xdcc4c", "preferred_image_base": "0x140000000", "sections": [ ".text", ".rdata", ".data", ".pdata", ".reloc" ], "authenticode_directory_size": 0 } }, { "artifact": "browser_dll_from_exe", "bytes": 1140224, "sha256": "28b7159e0f0702d595711318c34531e553e8e4910ba215912a9d4cfcf6cc0431", "parent_artifact": "inner_from_exe", "source_revision": null, "method": "Offline XOR and Base64 reconstruction", "pe": { "machine": "0x8664", "entry_rva": "0xb5844", "preferred_image_base": "0x180000000", "sections": [ ".text", ".rdata", ".data", ".pdata", ".fptable", ".reloc" ], "authenticode_directory_size": 0 } }, { "artifact": "browser_dll_from_msi", "bytes": 1140224, "sha256": "1f9ee6cb61f77176208b5cf3cc59f739b543520536de4d1ca141de3a4b03de4e", "parent_artifact": "inner_from_msi", "source_revision": null, "method": "Offline XOR and Base64 reconstruction", "pe": { "machine": "0x8664", "entry_rva": "0xb5844", "preferred_image_base": "0x180000000", "sections": [ ".text", ".rdata", ".data", ".pdata", ".fptable", ".reloc" ], "authenticode_directory_size": 0 } } ], "containers": [ { "artifact": "advertised_exe", "footer_magic": "0x6d512115", "data_offset": 519590, "data_bytes": 6682637, "footer_bytes": 12, "bounds_sum_matches_file": true, "encoded_stream_declared_bytes": 2662404 }, { "artifact": "msi_embedded_loader", "footer_magic": "0x28eec550", "data_offset": 482878, "data_bytes": 6652430, "footer_bytes": 12, "bounds_sum_matches_file": true, "encoded_stream_declared_bytes": 2662404 } ], "inner_comparison": { "differing_bytes": 101, "total_bytes": 2662400, "identical_raw_sections": [ ".text", ".data", ".pdata", ".reloc" ], "differences": { "COFF_timestamp_bytes": 3, "rdata_bytes": 98 }, "caveat": "Same code does not mean identical configuration or runtime outcome" }, "browser_dll_comparison": { "differing_bytes": 42, "total_bytes": 1140224, "identical_machine_code": true, "differences": "Numeric configuration, generated internal DLL name and timestamp fields" }, "outer_analysis": { "sample_sha256": "056f5bdc2cb87c8d1290311cc9735e9104d45c6148021f5bd33857f5c14f523a", "method": "Static Ghidra decompiler review plus independent Capstone/pefile disassembly and constant/string decoding. Sample never executed. No attacker infrastructure accessed.", "entry_workflow": { "pe_entry_va": "0x140033ba4", "crt_startup_va": "0x140033a28", "rust_runtime_va": "0x14000bb90", "application_va": "0x140006fb0", "runtime_note": "Thread bookkeeping, stack guarantee and Rust exception handler precede callback to application. Do not count this runtime handler as the malicious VEH.", "application_note": "Loads user32.dll and shell32.dll; obtains and reads its own executable; validates/extracts overlay and decodes inner buffer. On decoded-success path calls current-module header wiper before execution dispatcher0x140008200. After dispatcher returns, zeros decoded buffer and attempts delayed self-deletion before ExitProcess(0)." }, "environment_gate": { "va": "0x140009960", "caller_va": "0x140008200", "bypass_sentinel": "%USERPROFILE%\\Desktop\\12356.txt", "sentinel_semantics": "Successful filesystem metadata query returns allow immediately, bypassing DLL and username checks. No content check observed; not an inhibit/kill-switch file.", "metadata_helper_va": "0x1400216f0", "environment_helper_va": "0x14000db00", "environment_helper_winapi": "GetEnvironmentVariableW at0x14001f43d", "xor_key": "0x16", "dlls": [ { "name": "sbiedll.dll", "cipher_file_offset": "0x43ca3" }, { "name": "api_log.dll", "cipher_file_offset": "0x43cae" }, { "name": "pstorec.dll", "cipher_file_offset": "0x43cb9" }, { "name": "cuckoomon.dll", "cipher_file_offset": "0x43cc4" }, { "name": "cmdvrt32.dll", "cipher_file_offset": "0x43cd1" }, { "name": "cmdvrt64.dll", "cipher_file_offset": "0x43cdd" }, { "name": "avghookx.dll", "cipher_file_offset": "0x43ce9" }, { "name": "avghooka.dll", "cipher_file_offset": "0x43cf5" }, { "name": "snxhk.dll", "cipher_file_offset": "0x43d01" }, { "name": "tracer.dll", "cipher_file_offset": "0x43d0a" }, { "name": "vmGuestLib.dll", "cipher_file_offset": "0x43d14" }, { "name": "vboxdisp.dll", "cipher_file_offset": "0x43d22" }, { "name": "vboxhook.dll", "cipher_file_offset": "0x43d2e" }, { "name": "vboxmrxnp.dll", "cipher_file_offset": "0x43d3a" } ], "dll_semantics": "GetModuleHandleA tests already-loaded DLLs, not process list, installed software, registry or network. Any listed module found returns deny.", "username_substrings": [ "sandbox", "virus", "malware", "sample", "test", "wdagutilityaccount", "hal9th", "defaultaccount" ], "username_semantics": "Lowercase USERNAME, deny if any substring occurs. Missing/unusable environment value falls through to allow. This is heuristic filtering and does not prove a VM or debugger." }, "header_wipe": { "va": "0x14000c0a0", "target": "GetModuleHandleA(NULL), first0x200 bytes of current process image", "operations": "Resolve kernel32.dll!VirtualProtect by module/export hash; set PAGE_READWRITE(4); zero512 bytes; set PAGE_EXECUTE_READ(0x20).", "caveat": "Memory only, no disk header alteration. Final protection is hardcoded RX rather than restore-old. Resolver rejects forwarded export RVAs, so actual success depends on Windows export layout; static presence does not prove success." }, "conditional_breakpoint_interception": { "setup_va": "0x14000ac80", "handler_va": "0x14000f270", "context_setup_va": "0x14000e9d0", "mechanism": "Registers RtlAddVectoredExceptionHandler(first=1); locates already-loaded amsi/ntdll/wldp exports; uses NtGetContextThread/NtSetContextThread with pseudo-handle-2(current thread), CONTEXT_DEBUG_REGISTERS0x100010, DR0..DR3 and DR7 local execution breakpoints.", "targets": [ { "module": "amsi.dll", "api": "AmsiScanBuffer", "handler_type": 1, "forced_rax": "0x80070057(E_INVALIDARG)" }, { "module": "ntdll.dll", "api": "EtwEventWrite", "handler_type": 2, "forced_rax": "0" }, { "module": "wldp.dll", "api": "WldpQueryDynamicCodeTrust", "handler_type": 2, "forced_rax": "0" } ], "handler_semantics": "Checks EXCEPTION_SINGLE_STEP0x80000004, matches CONTEXT.Rip with stored target; writes forced return value toRax, restoresRip from[Rsp], advancesRsp by8, clearsDr6, returnsEXCEPTION_CONTINUE_EXECUTION(-1). Does not patch target function bytes.", "caveats": [ "No success assertion: modules and nonforwarded exports must be present, context operations must succeed.", "Configures current thread only. Primary mapped payload starts on a newly created thread, so do not claim effective bypass for inner payload or process-wide coverage.", "AMSI forced return is an error, not an explicit AMSI_RESULT_CLEAN out-parameter. Behavior of calling software on error is not established." ] }, "outer_self_deletion": { "owner_va": "0x140006fb0", "own_path_helper_va": "0x1400258c0", "cmd_constructor_va": "0x14000e7c0", "string_va": "0x140045274", "command_semantics": "Creates cmd.exe with /c and a command that waits via ping-n3 to127.0.0.1 then del of quoted own executable path. CREATE_NO_WINDOW0x08000000. Spawn attempt followed by ExitProcess(0); no deletion-success confirmation.", "path_requirement": "Ownpath conversion must be valid UTF8 for branch to spawn cleanup.", "important": "Can be attempted even if dispatcher returned because environment gate rejected execution." }, "disk_fallback": { "va": "0x14000b4d0", "name_seed": "GetTickCount64, low32(ticks*0x4c957f2d+0xf767814f)", "directory": "TEMP or . fallback", "operations": "Writes decoded payload to tick-derived.exe, writes embedded123472-byte vcruntime140.dll into same directory; resolves CreateProcessA/WaitForSingleObject/CloseHandle/TerminateProcess; SetErrorMode0x8003 if available; launchesCREATE_NO_WINDOW; waits90000ms; ifWAIT_TIMEOUT0x102 and TerminateProcess resolved, requests exitcode1; closeshandles; sleeps1000ms; attemptsDeleteFileW of payload file.", "caveat": "This fallback does not itself delete the outer loader. It does not remove companion DLL on its own shown path." }, "directory_fallback_cleanup": { "va": "0x14000bcd0", "operations": "For separate per-run directory execution path: retry decodedexe deletion up to10 times, sleeping500ms after failure; delete companionvcruntime140.dll once; RemoveDirectoryW on supplied staging directory.", "caveat": "No success confirmation; distinct from simpler TEMP fallback." }, "avoid_false_claims": [ "GetTickCount64 is used for temporary filename generation, not observed timing-based anti-analysis.", "Sleep3600000 occurs as child-wait fallback if wait API resolution fails, not an initial one-hour sandbox gate.", "IsDebuggerPresent import is called at0x1400385cf in CRT exception/failure handling; do not present import alone as application debugger detection.", "No hardware breakpoint or anti-analysis effectiveness was dynamically tested." ], "resolved_hashes": { "kernel32.dll": "a9471459", "VirtualProtect": "8f600b21", "ntdll.dll": "3b7c3cb1", "RtlAddVectoredExceptionHandler": "a05c4f97", "amsi.dll": "ff64811b", "AmsiScanBuffer": "7ab09d7c", "EtwEventWrite": "aa33419a", "wldp.dll": "798c6950", "WldpQueryDynamicCodeTrust": "ce9014f8", "HeapAlloc": "e2342c9c", "NtGetContextThread": "8cb00aa0", "NtSetContextThread": "5ec4433c", "HeapFree": "ae67489f" } }, "network_indicators": [ { "value": "hxxps://t[.]me/gerj_threuh", "role": "URL embedded in payload configuration; dynamic destination discovery path", "provenance": "Inner EXE XOR-decoded string at RVA 0xe58a8", "contacted_by_researcher": false }, { "value": "hxxps://seall-vernous[.]com:443", "role": "Embedded fallback destination", "provenance": "Inner EXE XOR-decoded string at RVA 0xe58c0", "contacted_by_researcher": false } ], "limits": [ "No observed victim infection or exfiltration", "No live infrastructure availability test", "No demonstrated security-product bypass", "No definitive family or real-world operator attribution", "No broad YARA false-positive benchmark" ], "yara_validation": { "yara_version": "4.5.4", "rule_sha256": "f172c8d06a8eca34f8f250de2055277c19658bb256a17fc5cb02c82f4e147d83", "method": "Compile and read-only YARA file-byte scanning; corrupted controls created in memory; samples never executed; no sample mutations saved.", "scope": "Focused four-positive fixture validation; no broad false-positive benchmark or family-wide coverage.", "summary": { "positive_cases": 4, "negative_cases": 11, "passed": 15, "total": 15 }, "results": [ { "fixture": "J@IL_GPT-4.5.exe.sample", "kind": "reviewed_positive", "bytes": 7202239, "sha256": "056f5bdc2cb87c8d1290311cc9735e9104d45c6148021f5bd33857f5c14f523a", "expected": [ "OFFSEQ_JAILGPT_Outer_Log_Container_Lineage_202609" ], "actual": [ "OFFSEQ_JAILGPT_Outer_Log_Container_Lineage_202609" ], "passed": true }, { "fixture": "historical-msi-Binary.p.sample", "kind": "reviewed_positive", "bytes": 7135320, "sha256": "485f69d2d9515ad7d64382d8e986964815a6528f0c61ff62dce307690900c5d0", "expected": [ "OFFSEQ_JAILGPT_Outer_Log_Container_Lineage_202609" ], "actual": [ "OFFSEQ_JAILGPT_Outer_Log_Container_Lineage_202609" ], "passed": true }, { "fixture": "inner-head.sample", "kind": "reviewed_positive", "bytes": 2662400, "sha256": "e395fd44a750ccc4da5740d83645fda7b2cdc0bb9de3fd6e8cbfba7ac90c3feb", "expected": [ "OFFSEQ_JAILGPT_Recovered_Inner_PE_Lineage_202609" ], "actual": [ "OFFSEQ_JAILGPT_Recovered_Inner_PE_Lineage_202609" ], "passed": true }, { "fixture": "inner-historical-msi.sample", "kind": "reviewed_positive", "bytes": 2662400, "sha256": "f8dfd1e44ad3acd3e7fd0cff6cb0f02f0c2e88ebbc363990c22517f78a0c0011", "expected": [ "OFFSEQ_JAILGPT_Recovered_Inner_PE_Lineage_202609" ], "actual": [ "OFFSEQ_JAILGPT_Recovered_Inner_PE_Lineage_202609" ], "passed": true }, { "fixture": "main.py.txt", "kind": "benign_repository_text", "bytes": 23, "sha256": "a608d77ed5bb0b0268e2c2cdb418048a31dd9b5df886f175c6ce724b61b3ceb9", "expected": [], "actual": [], "passed": true }, { "fixture": "README.md.txt", "kind": "benign_repository_text", "bytes": 1019, "sha256": "61187dc0505ea19cc45ac824e44ada52d2aa1a246e3bb4ed4d6c65530ade2741", "expected": [], "actual": [], "passed": true }, { "fixture": "local_python_executable", "kind": "benign_local_executable", "bytes": 102352, "sha256": "bdea59019a38eb6600cc9e71e984a97fedadc406448431281e7657030f54987e", "expected": [], "actual": [], "passed": true }, { "fixture": "J@IL_GPT-4.5.exe.sample::truncated_one_byte", "kind": "in_memory_truncation_control", "bytes": 7202238, "sha256": "6c174a3baf3c1bc675d84c2397902c37a045e8d82fe5f542d7fd71cf81dab38c", "expected": [], "actual": [], "passed": true }, { "fixture": "historical-msi-Binary.p.sample::truncated_one_byte", "kind": "in_memory_truncation_control", "bytes": 7135319, "sha256": "dd9a6d75d55f1beef072f1713d9edf3af95d7177a24fd1dc3294fb4a86f878f4", "expected": [], "actual": [], "passed": true }, { "fixture": "inner-head.sample::truncated_one_byte", "kind": "in_memory_truncation_control", "bytes": 2662399, "sha256": "4b98ba81cb11b114f84b0e19bff682528c9bfd6c75dba8c3e72cceb4578734e1", "expected": [], "actual": [], "passed": true }, { "fixture": "inner-historical-msi.sample::truncated_one_byte", "kind": "in_memory_truncation_control", "bytes": 2662399, "sha256": "287b71948121eaf19617b15dd62e2515556e5a40a16cafaa913e7806907cd28e", "expected": [], "actual": [], "passed": true }, { "fixture": "J@IL_GPT-4.5.exe.sample::footer_magic_one_bit_changed", "kind": "in_memory_footer_control", "bytes": 7202239, "sha256": "896f57d3b42cd3119c2a1921423bf2ad720d22ec69ae0fc43ece60c217375204", "expected": [], "actual": [], "passed": true }, { "fixture": "J@IL_GPT-4.5.exe.sample::footer_length_plus_one", "kind": "in_memory_footer_control", "bytes": 7202239, "sha256": "aa427117b9fb4f9d31a6b4f1bbb75fe049ab537594318440c1fef840e9e15684", "expected": [], "actual": [], "passed": true }, { "fixture": "historical-msi-Binary.p.sample::footer_magic_one_bit_changed", "kind": "in_memory_footer_control", "bytes": 7135320, "sha256": "d7f90a3bf38da22259493355a534a3e512e2cd3552418eb7e711e73c1fce4bc1", "expected": [], "actual": [], "passed": true }, { "fixture": "historical-msi-Binary.p.sample::footer_length_plus_one", "kind": "in_memory_footer_control", "bytes": 7135320, "sha256": "348e43db2c7ff4184dbffd42cf413a35bf71723ceaf931b87d92faaaeafa7fe7", "expected": [], "actual": [], "passed": true } ] }, "user_supplied_screenshot": { "date": "2026-09-06", "file": "domain-warning-20260906.png", "bytes": 137077, "sha256": "a09eb7bb8d1bf3afb9b41f565336da59256677908135f7a25d2658febf613b43", "observation": "Browser navigation over HTTP displays malware-warning page for embedded fallback domain", "source": "User supplied screenshot; not an independent researcher network capture", "limits": "No proof of HTTPS upload success, victim infection or provider attribution" }, "application_file_upload": { "queue_function": "0x1400214b0", "flush_function": "0x140024170", "batch_threshold_bytes": 10485760, "types": [ "apps", "apps_complete" ], "file_fields": [ "app", "path", "data" ], "data_encoding": "standard Base64 via0x14003d720", "storage": "in-memory triples; paths are logical exfiltration labels, not proof of plaintext disk writes", "call_chain": [ "0x1400543e0", "0x1400689e0", "0x1400214b0", "0x140024170", "0x140013970", "0x140012d10", "WinHttpSendRequest" ] }, "collectors": [ { "function": "0x140042a20", "targets": "Obsidian IndexedDB, obsidian.json, vault paths", "decoded_constants": [ { "va": "1400e7bb3", "length": 20, "plain": "\\obsidian\\IndexedDB\\" }, { "va": "1400e7bc7", "length": 25, "plain": "\\Apps\\Obsidian\\IndexedDB\\" }, { "va": "1400e7be0", "length": 23, "plain": "\\obsidian\\obsidian.json" }, { "va": "1400e7bb0", "length": 2, "plain": "\\\\" }, { "va": "1400e7b28", "length": 5, "plain": "vault" }, { "va": "1400e7bf7", "length": 15, "plain": "\\Apps\\Obsidian\\" }, { "va": "1400e7bb2", "length": 1, "plain": "\\" } ] }, { "function": "0x1400788a0", "targets": "Notion/notion.db", "decoded_constants": [ { "va": "1400ea7bc", "length": 8, "plain": "\\Notion\\" }, { "va": "1400ea7c4", "length": 13, "plain": "\\Apps\\Notion\\" }, { "va": "1400ea7d1", "length": 9, "plain": "notion.db" }, { "va": "1400ea7d1", "length": 9, "plain": "notion.db" } ] }, { "function": "0x140011d10", "targets": "Microsoft OneNote cache and extracted text", "decoded_constants": [ { "va": "1400e5470", "length": 18, "plain": "\\Microsoft\\OneNote" }, { "va": "1400e551e", "length": 5, "plain": "cache" }, { "va": "1400e5482", "length": 14, "plain": "\\Apps\\OneNote\\" }, { "va": "1400e5490", "length": 116, "plain": "OneNote extracted data (maybe contains corrupted text)\n------------------------------------------------------------\n" }, { "va": "1400e5508", "length": 7, "plain": "onenote" }, { "va": "1400e550f", "length": 15, "plain": "Information.txt" } ] }, { "function": "0x140073d20", "targets": "Evernote conduit-storage", "decoded_constants": [ { "va": "1400ea5c3", "length": 25, "plain": "\\Evernote\\conduit-storage" }, { "va": "1400ea5dc", "length": 15, "plain": "\\Apps\\Evernote\\" } ] }, { "function": "0x140071460", "targets": "NordVPN user.config", "decoded_constants": [ { "va": "1400ea538", "length": 8, "plain": "\\NordVPN" }, { "va": "1400ea540", "length": 11, "plain": "NordVpn.exe" }, { "va": "1400ea54b", "length": 11, "plain": "user.config" }, { "va": "1400ea556", "length": 14, "plain": "\\Apps\\NordVPN\\" }, { "va": "1400ea564", "length": 1, "plain": "\\" }, { "va": "1400ea565", "length": 12, "plain": "\\user.config" }, { "va": "1400ea571", "length": 7, "plain": "nordvpn" } ] }, { "function": "0x1400720e0", "targets": "OpenVPN Connect profiles / ovpn", "decoded_constants": [ { "va": "1400ea578", "length": 25, "plain": "\\OpenVPN Connect\\profiles" }, { "va": "1400ea591", "length": 4, "plain": "ovpn" }, { "va": "1400ea595", "length": 14, "plain": "\\Apps\\OpenVPN\\" }, { "va": "1400ea5a3", "length": 7, "plain": "openvpn" } ] }, { "function": "0x1400746b0", "targets": "Private Internet Access pia_manager", "decoded_constants": [ { "va": "1400ea5fe", "length": 12, "plain": "\\pia_manager" } ] }, { "function": "0x140050590", "targets": "ProtonVPN user.config", "decoded_constants": [ { "va": "1400e8bb0", "length": 10, "plain": "\\ProtonVPN" }, { "va": "1400e8bba", "length": 10, "plain": "ProtonVPN_" }, { "va": "1400e8bc4", "length": 11, "plain": "user.config" }, { "va": "1400e8bcf", "length": 16, "plain": "\\Apps\\ProtonVPN\\" }, { "va": "1400e8bdf", "length": 12, "plain": "\\user.config" }, { "va": "1400e8beb", "length": 9, "plain": "protonvpn" } ] }, { "function": "0x140056bd0", "targets": "WinSCP sessions, HostName/UserName/Password/PortNumber", "decoded_constants": [ { "va": "1400e911b", "length": 41, "plain": "Software\\Martin Prikryl\\WinSCP 2\\Sessions" }, { "va": "1400e9168", "length": 8, "plain": "HostName" }, { "va": "1400e9170", "length": 8, "plain": "UserName" }, { "va": "1400e9178", "length": 8, "plain": "Password" }, { "va": "1400e9180", "length": 10, "plain": "PortNumber" }, { "va": "1400e918a", "length": 10, "plain": "Hostname: " }, { "va": "1400e9194", "length": 1, "plain": ":" }, { "va": "1400e9195", "length": 11, "plain": "\nUsername: " }, { "va": "1400e91a0", "length": 11, "plain": "\nPassword: " }, { "va": "1400e9144", "length": 2, "plain": "\n\n" }, { "va": "1400e9146", "length": 28, "plain": "\\Apps\\WinSCP\\Credentials.txt" }, { "va": "1400e9162", "length": 6, "plain": "winscp" } ] }, { "function": "0x1400689e0", "targets": "CoreFTP sites, Host/User/PW; password recovery", "decoded_constants": [ { "va": "1400e9c80", "length": 30, "plain": "SOFTWARE\\FTPWare\\COREFTP\\Sites" }, { "va": "1400e9cc4", "length": 4, "plain": "Host" }, { "va": "1400e9cc8", "length": 4, "plain": "User" }, { "va": "1400e9ccc", "length": 2, "plain": "PW" }, { "va": "1400e9cce", "length": 10, "plain": "Hostname: " }, { "va": "1400e9cd8", "length": 11, "plain": "\nUsername: " }, { "va": "1400e9ce3", "length": 11, "plain": "\nPassword: " }, { "va": "1400e9c9e", "length": 2, "plain": "\n\n" }, { "va": "1400e9ca0", "length": 29, "plain": "\\Apps\\CoreFTP\\Credentials.txt" }, { "va": "1400e9cbd", "length": 7, "plain": "coreftp" } ] }, { "function": "0x1400525e0", "targets": "FileZilla recentservers.xml/sitemanager.xml, Host/Port/User/Pass", "decoded_constants": [ { "va": "1400e8dd9", "length": 11, "plain": "\\FileZilla\\" }, { "va": "1400e8de4", "length": 17, "plain": "recentservers.xml" }, { "va": "1400e8df5", "length": 15, "plain": "sitemanager.xml" }, { "va": "1400e8d60", "length": 7, "plain": "" }, { "va": "1400e8da8", "length": 4, "plain": "Host" }, { "va": "1400e8dac", "length": 4, "plain": "Port" }, { "va": "1400e8db0", "length": 4, "plain": "User" }, { "va": "1400e8db4", "length": 4, "plain": "Pass" }, { "va": "1400e8db8", "length": 10, "plain": "Hostname: " }, { "va": "1400e8dc2", "length": 1, "plain": ":" }, { "va": "1400e8dc3", "length": 11, "plain": "\nUsername: " }, { "va": "1400e8dce", "length": 11, "plain": "\nPassword: " }, { "va": "1400e8e2e", "length": 16, "plain": "\\Apps\\FileZilla\\" }, { "va": "1400e8e25", "length": 9, "plain": "filezilla" }, { "va": "1400e8e04", "length": 2, "plain": "\n\n" }, { "va": "1400e8e06", "length": 31, "plain": "\\Apps\\FileZilla\\Credentials.txt" }, { "va": "1400e8e25", "length": 9, "plain": "filezilla" } ] }, { "function": "0x140077930", "targets": "Jabber clients Pidgin, Psi, Psi+; accounts.xml and OTR keys", "decoded_constants": [ { "va": "1400ea705", "length": 9, "plain": "\\.purple\\" }, { "va": "1400ea70e", "length": 6, "plain": "Pidgin" }, { "va": "1400ea714", "length": 22, "plain": "\\Psi\\profiles\\default\\" }, { "va": "1400ea72a", "length": 3, "plain": "Psi" }, { "va": "1400ea72d", "length": 23, "plain": "\\Psi+\\profiles\\default\\" }, { "va": "1400ea744", "length": 4, "plain": "Psi+" }, { "va": "1400ea748", "length": 12, "plain": "accounts.xml" }, { "va": "1400ea754", "length": 16, "plain": "otr.fingerprints" }, { "va": "1400ea764", "length": 8, "plain": "otr.keys" }, { "va": "1400ea76c", "length": 15, "plain": "otr.private_key" }, { "va": "1400ea77b", "length": 13, "plain": "\\Apps\\Jabber\\" }, { "va": "1400ea788", "length": 1, "plain": "\\" }, { "va": "1400ea789", "length": 6, "plain": "jabber" } ] }, { "function": "0x14005efa0", "targets": "Pidgin account credentials and chat logs", "decoded_constants": [ { "va": "1400e9750", "length": 8, "plain": "\\.purple" }, { "va": "1400e963e", "length": 13, "plain": "\\accounts.xml" }, { "va": "1400e9668", "length": 9, "plain": "" }, { "va": "1400e96ea", "length": 28, "plain": "\\Apps\\Pidgin\\Credentials.txt" }, { "va": "1400e9706", "length": 6, "plain": "pidgin" }, { "va": "1400e9690", "length": 10, "plain": "" }, { "va": "1400e9610", "length": 5, "plain": "\\logs" }, { "va": "1400e9615", "length": 22, "plain": "\\Apps\\Pidgin\\chatlogs\\" }, { "va": "1400e96b8", "length": 8, "plain": "protocol" }, { "va": "1400e96c0", "length": 4, "plain": "name" }, { "va": "1400e96c4", "length": 8, "plain": "password" }, { "va": "1400e96cc", "length": 10, "plain": "Protocol: " }, { "va": "1400e96d6", "length": 7, "plain": "\nName: " }, { "va": "1400e96dd", "length": 11, "plain": "\nPassword: " }, { "va": "1400e96e8", "length": 2, "plain": "\n\n" } ] }, { "function": "0x14006ddf0", "targets": "Signal databases, Session Storage, Local Storage, config.json", "decoded_constants": [ { "va": "1400ea29d", "length": 7, "plain": "\\Signal" }, { "va": "1400ea2a4", "length": 9, "plain": "databases" }, { "va": "1400ea2ad", "length": 15, "plain": "Session Storage" }, { "va": "1400ea2bc", "length": 13, "plain": "Local Storage" }, { "va": "1400ea2c9", "length": 3, "plain": "sql" }, { "va": "1400ea2f0", "length": 1, "plain": "\\" }, { "va": "1400ea2f1", "length": 13, "plain": "\\Apps\\Signal\\" }, { "va": "1400ea2f0", "length": 1, "plain": "\\" }, { "va": "1400ea2cc", "length": 12, "plain": "\\config.json" }, { "va": "1400ea2d8", "length": 24, "plain": "\\Apps\\Signal\\config.json" }, { "va": "1400ea297", "length": 6, "plain": "signal" } ] }, { "function": "0x140073590", "targets": "Tox profile files", "decoded_constants": [ { "va": "1400ea5ad", "length": 4, "plain": "\\Tox" }, { "va": "1400ea5b1", "length": 10, "plain": "\\Apps\\Tox\\" } ] }, { "function": "0x140044000", "targets": "Roblox cookies and RobloxStudio LoggedInUsersStore", "decoded_constants": [ { "va": "1400e7e58", "length": 6, "plain": "Roblox" }, { "va": "1400e7e5e", "length": 12, "plain": "LocalStorage" }, { "va": "1400e7e6a", "length": 17, "plain": "RobloxCookies.dat" }, { "va": "1400e7e7b", "length": 29, "plain": "\"CookiesData\"\\s*:\\s*\"([^\"]+)\"" }, { "va": "1400e7ec8", "length": 10, "plain": "#HttpOnly_" }, { "va": "1400e7ed2", "length": 1, "plain": ";" }, { "va": "1400e7ed3", "length": 70, "plain": "Software\\Roblox\\RobloxStudio\\LoggedInUsersStore\\https:\\\\www.roblox.com" }, { "va": "1400e7f19", "length": 5, "plain": "users" } ] }, { "function": "0x140061720", "targets": "Desktop/Documents/Downloads file grabber", "decoded_constants": [ { "va": "1400ea830", "length": 8, "plain": "\\Desktop" }, { "va": "1400e97ca", "length": 7, "plain": "Desktop" }, { "va": "1400e97d1", "length": 9, "plain": "Documents" }, { "va": "1400ea842", "length": 10, "plain": "\\Downloads" }, { "va": "1400e97da", "length": 9, "plain": "Downloads" }, { "va": "1400e97f2", "length": 3, "plain": "rdp" }, { "va": "1400e97f5", "length": 4, "plain": "seed" }, { "va": "1400e97f9", "length": 10, "plain": "privatekey" }, { "va": "1400e980c", "length": 2, "plain": "pk" }, { "va": "1400e980e", "length": 7, "plain": "passkey" }, { "va": "1400e9815", "length": 3, "plain": "dat" }, { "va": "1400e9818", "length": 8, "plain": "keystore" }, { "va": "1400e9820", "length": 6, "plain": "mafile" }, { "va": "1400e9826", "length": 4, "plain": "seco" }, { "va": "1400e982a", "length": 2, "plain": "py" }, { "va": "1400e982c", "length": 3, "plain": "png" }, { "va": "1400e982f", "length": 3, "plain": "jpg" }, { "va": "1400e9832", "length": 4, "plain": "jpeg" } ] }, { "function": "0x140030b30", "targets": "Discord, Canary, PTB LevelDB/Local State and memory paths", "decoded_constants": [ { "va": "1400e6e8f", "length": 9, "plain": "\\Discord\\" }, { "va": "1400e6e16", "length": 7, "plain": "leveldb" }, { "va": "1400e6e98", "length": 15, "plain": "\\discordcanary\\" }, { "va": "1400e6ea7", "length": 14, "plain": "Discord_Canary" }, { "va": "1400e6eb5", "length": 12, "plain": "\\discordptb\\" }, { "va": "1400e6ec1", "length": 11, "plain": "Discord_PTB" }, { "va": "1400e6f17", "length": 22, "plain": "Local Storage\\leveldb\\" }, { "va": "1400e6f35", "length": 11, "plain": "Local State" }, { "va": "1400e6f17", "length": 22, "plain": "Local Storage\\leveldb\\" }, { "va": "1400e6f35", "length": 11, "plain": "Local State" }, { "va": "1400e6ecc", "length": 6, "plain": "memory" }, { "va": "1400e6ed2", "length": 20, "plain": "\\Discord\\Local State" }, { "va": "1400e6ecc", "length": 6, "plain": "memory" }, { "va": "1400e6ee6", "length": 26, "plain": "\\discordcanary\\Local State" }, { "va": "1400e6ecc", "length": 6, "plain": "memory" }, { "va": "1400e6f00", "length": 23, "plain": "\\discordptb\\Local State" } ] }, { "function": "0x14003b200", "targets": "Telegram tdata discovery and collection", "decoded_constants": [ { "va": "1400ea842", "length": 10, "plain": "\\Downloads" }, { "va": "1400ea830", "length": 8, "plain": "\\Desktop" }, { "va": "1400e7530", "length": 9, "plain": "user_data" }, { "va": "1400e7539", "length": 5, "plain": "dumps" }, { "va": "1400e753e", "length": 5, "plain": "emoji" }, { "va": "1400e7543", "length": 6, "plain": "tdummy" }, { "va": "1400e7549", "length": 4, "plain": "temp" }, { "va": "1400e754d", "length": 7, "plain": "working" }, { "va": "1400e7554", "length": 22, "plain": "shortcuts-default.json" }, { "va": "1400e756a", "length": 21, "plain": "shortcuts-custom.json" }, { "va": "1400e757f", "length": 7, "plain": "webview" }, { "va": "1400e7586", "length": 4, "plain": "logs" }, { "va": "1400e758a", "length": 9, "plain": "tdata_old" }, { "va": "1400e7593", "length": 6, "plain": "update" }, { "va": "1400e7539", "length": 5, "plain": "dumps" }, { "va": "1400e7549", "length": 4, "plain": "temp" }, { "va": "1400e7530", "length": 9, "plain": "user_data" }, { "va": "1400e7599", "length": 5, "plain": ".lock" }, { "va": "1400e7620", "length": 5, "plain": "cache" }, { "va": "1400e7625", "length": 11, "plain": "media_cache" }, { "va": "1400e7630", "length": 3, "plain": "tmp" }, { "va": "1400e7549", "length": 4, "plain": "temp" }, { "va": "1400e759e", "length": 1, "plain": "\\" }, { "va": "1400e759f", "length": 6, "plain": "\\tdata" }, { "va": "1400e759e", "length": 1, "plain": "\\" }, { "va": "1400e759e", "length": 1, "plain": "\\" }, { "va": "1400e759e", "length": 1, "plain": "\\" }, { "va": "1400e759f", "length": 6, "plain": "\\tdata" }, { "va": "1400e759e", "length": 1, "plain": "\\" } ] }, { "function": "0x14001e020", "targets": "Steam files and installed-app metadata", "decoded_constants": [ { "va": "1400e60bc", "length": 7, "plain": "\\Steam\\" }, { "va": "1400e60bc", "length": 7, "plain": "\\Steam\\" }, { "va": "1400e60c3", "length": 25, "plain": "Software\\Valve\\Steam\\Apps" }, { "va": "1400e60dc", "length": 4, "plain": "Name" } ] } ], "screen_capture_call_chain": [ "0x1400543e0", "0x140053c60", "0x14002a970", "0x14009ca60", "0x14009cc50", "StretchBlt/GetDIBits" ], "etw_patch": { "function": "0x140040440", "target": "ntdll!EtwEventWrite", "bytes": "33c0c3", "meaning": "xor eax,eax; ret", "condition": "attempted from main; boolean failure ignored" }, "dll_injection": { "decode_function": "0x14007ac40", "blob_rva": "0xeaf74", "encoded_bytes": 1520300, "browser_dispatch": "0x140053c60", "process_create_function": "0x140078530", "process_flags": 4, "process_flags_name": "CREATE_SUSPENDED", "command_arguments": [ "--headless", "--incognito or --disable-gpu" ], "incognito_gate": "flag local_129 starts1 and resets0 only after a successful injection; first successful browser receives --incognito, enabling DLL worker persistence branch if its additional conditions hold", "exact_browser_limit": "discovered browser hash-map iteration order; no fixed first browser proven", "remote_loader_function": "0x14006c590", "export": "KdMXFBaWQ", "native_call_sequence": [ "ZwAllocateVirtualMemory(RW)", "ZwWriteVirtualMemory(entire DLL)", "ZwProtectVirtualMemory(RX)", "ZwCreateThreadEx(remote_base+export_offset,remote_base)" ] }, "upload_protocol": { "central_sender": "0x140013970", "http_helper": "0x140012d10", "dead_drop_extract": "tgme_page_description div text; strip markup; prepend https:// and append :443; empty POST probe", "empty_probe_limitation": "successful send returns without full response read; not proof of currently responding C2", "method": "POST", "tls_security_flags": "0x3300", "timeout_ms": [ 10000, 10000, 600000, 600000 ], "frame": "LE32(12+16+ciphertext_length)||SHA256(secret||secret)[:12]||IV16||AES256-CBC-PKCS7(SHA256(secret),IV,serialized_data)", "head_marker_hex": "f5446133b530c210154507e1", "historical_marker_hex": "5e8f010ae8f9694e42d5cb63", "marker_visibility": "inside HTTPS; memory or decrypted-body use only" }, "browser_dll_collection": { "entry_chain": [ "Reflective export KdMXFBaWQ RVA0x1fcf0 maps PE and calls image entry with process-attach reason", "CRT entry calls DllMain at0x180012f78", "DllMain creates worker thread0x180012414", "Worker selects Chromium-family or Firefox collection paths and serializes output before encrypted network send" ], "chromium_collection_fn": "0x180002a80", "chromium_sql_and_collection": { "cookies": "0x180003cb0", "credit_cards_and_local_stored_cvc": "0x180004be0", "service_tokens_and_binding_keys": "0x180005870" }, "firefox_collection_fn": "0x180013850", "firefox_cookies_fn": "0x180014f98", "firefox_credentials_fn": "0x180013f1c", "firefox_nss_resolution_fn": "0x18000edf0", "decryption": "Code extracts legacy encrypted_key and app_bound_encrypted_key from Local State, contains COM-based app-bound key recovery paths and invokes browser-data decryption routines. Successful decryption was not tested.", "decryption_anchors": [ "0x18000df54", "0x18000e53c", "0x18000dad8" ], "confidence": "Working collection/decryption call paths are statically present; no runtime collection, decryption success, victim data, or exfiltration was observed." }, "conditional_follow_on": { "gates": [ "DLL network-send routine returned success", "GetCommandLineW contains literal --incognito", "File %LOCALAPPDATA%\\Microsoft\\OfficeBroker\\svchost.exe is absent" ], "gates_anchors": { "worker": "0x180012414", "successful_send": "0x180012dca", "incognito_check": "0x180011e98", "missing_file_branch": "0x180012e6f..0x180012e95" }, "script_builder": "0x180011fc0", "launcher": "0x180017418", "primary_launcher": "ShellExecuteExW with lpVerb=runas and lpFile=powershell.exe; requests elevated execution, subject to Windows UAC configuration and consent/credentials.", "script_intent": [ "Create two user-local directories and mark them hidden/system", "Attempt Defender path exclusions via policy registry and Add-MpPreference", "Create two on-logon scheduled tasks requesting highest run level", "POST encrypted getPayload request; decrypt server response; write executable and a second copy; start the first copy hidden" ], "destinations": [ "%LOCALAPPDATA%\\Microsoft\\OfficeBroker\\svchost.exe", "%LOCALAPPDATA%\\Packages\\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\\AC\\Temp\\RuntimeBroker.exe" ], "tasks": [ { "name": "WindowsSystemService", "trigger": "onlogon", "runlevel": "highest", "target": "OfficeBroker\\svchost.exe" }, { "name": "RuntimeBrokerService", "trigger": "onlogon", "runlevel": "highest", "target": "RuntimeBroker.exe -Embedding" } ], "limits": [ "No server response payload was retrieved or executed.", "No successful elevation, Defender change, task creation, follow-on download, or persistence was observed.", "Primary launcher uses runas; an additional launcher fallback is present but not fully audited. Do not claim silent UAC bypass or guaranteed persistence.", "Downloader target is assembled from a discovered endpoint variable; do not claim that every fallback resolution branch produces a valid download URL." ] }, "extractor_validation": { "script_sha256": "9b4c58bd8622ecec72be791f09c300198ba0a427cfadabdf4ddd5d87c792dc73", "python": "3.9.6", "checks": [ { "check": "exe: isolated stdlib extraction, exact outputs, JSON, permissions", "passed": true }, { "check": "exe: existing outputs refused and unchanged", "passed": true }, { "check": "msi: isolated stdlib extraction, exact outputs, JSON, permissions", "passed": true }, { "check": "msi: existing outputs refused and unchanged", "passed": true }, { "check": "unknown: rejected before parsing; no output directory", "passed": true }, { "check": "changed-footer: rejected before parsing; no output directory", "passed": true } ], "method": "Analyst-owned extractor executed against preserved samples only as data; no sample code executed.", "editorial_note": "The tested code was unchanged; the opening docstring was clarified after validation." } }