3 ms·

Ask HN: I found malware on GitHub. How do I analyze the malware further?

19 points by koheripbal 6y ago

I have discovered some malicious behavior (corrected from title) in [Mark Text](https://github.com/marktext/marktext).... I ran Fiddler to profile Mark Text, and the program phones home... and more.... It exports a few basic things [such as your public IP address](https://i.imgur.com/UxyHkbA.png), and then a bunch of encrypted data (cannot decipher). ...then it downloads a packaged Chrome extension app (CR24 format). ...when unzipping that file, you can see [a base64 encoded payload](https://i.imgur.com/5rKwjW0.png) - which expands [to this](https://i.imgur.com/jMbd8st.png), and then an [unencrypted list of websites](https://i.imgur.com/H0twSDk.png), which is very clearly malicious. To be clear, I downloaded this [directly from Github](https://github.com/marktext/marktext). Unfortunately, my skills are limited and I cannot find references to the initial malicious URL in the code - though I did discover that you can [search Github code like this...](https://github.com/search?q=in%3Afile+gvt1+repo%3Amarktext%2Fmarktext) Credit to /u/Phily83 for first [seeing the network activity](https://ibb.co/zbHxbBv).

uberman 6y ago
While I can't speak to the list of sites that you see, but since the project includes electron-builder (one of the solutions to auto update apps) I would not be surprised to see redirector.gvt1.com activity as it is a google redirector service used to do things like updates. This link/bug report might also be pertinent: https://bugs.chromium.org/p/chromium/issues/detail?id=755068&can=1&q=Redirector.gvt1.com&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified https://bugs.chromium.org/p/chromium/issues/detail?id=755068...
- koheripbal 6y ago
  What makes it seem suspicious is that it sends my public IP address in the URL as a parameter, has encrypted traffic in both directions, and downloads a bunch of suspicious looking domain names... 10proga.ru 123moviesgoto.com 1progs.ru 1sa.com.ua 24smi.co 24smi.org 2drive.ru 2hpc.ru 2recepta.com 3.kino.filmive-hd.net 34travel.me ...etc... I've opened an issue on Github: https://github.com/marktext/marktext/issues/2418 https://github.com/marktext/marktext/issues/2418
  - koheripbal 6y ago
    Look like it was a false alarm - devs checked the output out.
from 6y ago
The list of malicious sites is probably the safebrowsing block list in Google chrome. gvt1.com is a Google site used to download various Chrome related assets. Marktext uses Electron so it is automatically downloading these. EDIT: After decompressing http://r4---sn-8xgp1vo-xfgs.gvt1.com/edgedl/release2/chrome_component/AIn3zS2zP2W0T6dH89fdfUo_2020.11.29.1203/Vx5-bd3sH9glYb_6GC_ovw?cms_redirect=yes&mh=vQ&mip=<myPublicIPAddress>&mm=28&mn=sn-8xgp1vo-xfgs&ms=nvh&mt=1606761620&mv=m&mvi=4&pl=17&shardbypass=yes http://r4---sn-8xgp1vo-xfgs.gvt1.com/edgedl/release2/chrome_... (linked in the Github issue) and looking at the manifest.json, this is an extension called "Crowd Deny." Reading https://forum.vivaldi.net/topic/43831/crowd-deny-what-is-it/12 https://forum.vivaldi.net/topic/43831/crowd-deny-what-is-it/..., it seems to be used as a blacklist to stop push notification spam.
- koheripbal 6y ago
  So any Chromium/Electron app will download the list each day?
  - from 6y ago
    Maybe not every day but the list is periodically updated and if you reset your Chrome profile or delete the apps data directory it probably will.
deleted 6y ago
[deleted]