Malware Analysis - Unpacking Ageostealer built with Electron Framework
Channel: MalwareAnalysisForHedgehogs
Date: 2023-07-02

We investigate a "game" named crazydown.exe. The application was written in JavaScript and built with Electron Framework resulting in a huge Portable Executable. Where do we find the malware code in a 150 MB application?

My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

Sample: https://tria.ge/230701-ghxh4sgf7x
Asar Plugin: https://www.tc4shell.com/en/7zip/asar/
Electron: https://www.electronjs.org/docs/latest/

00:00 Intro, what is Electron Framework
00:50 Triage on VirusTotal
03:44 Unpacking Nullsoft
04:09 Unpacking .asar archive
06:52 Decrypting the JavaScript stealer

#js #javascript #malware #malwareanalysis #reverseengineering #unpacking #electron #stealer