4 ms·

It's the auto-update functionality from a now-suspect URL. The repo has since been taken down, but here's the suspect file: https://github.com/dbgsymbol/getsym

It's the auto-update functionality from a now-suspect URL. The repo has since been taken down, but here's the suspect file: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp#L44 https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

sillysaurusx 3y ago
Drat, archive.org didn't snag it. Do you happen to have a copy? https://web.archive.org/web/20230000000000*/https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp https://web.archive.org/web/20230000000000*/https://github.c...
- gregsadetsky 3y ago
  check https://github.com/bb33bb/getsymbol https://github.com/bb33bb/getsymbol and https://github.com/clayne/win-getsymbol https://github.com/clayne/win-getsymbol, two up to date forks -- and my comment above https://news.ycombinator.com/item?id=37425311 https://news.ycombinator.com/item?id=37425311
gregsadetsky 3y ago
Found these two forks which are still accessible (and are supposedly up to date with the upstream repo (linked in the comment above) which is not accessible anymore): https://github.com/bb33bb/getsymbol https://github.com/bb33bb/getsymbol https://github.com/clayne/win-getsymbol https://github.com/clayne/win-getsymbol here is the same link as in the comment above from one of the forks: https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMainDlg.cpp https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMai... the code fetches from `UPDATE_CHECK_URL`, which is hardcoded as: https://dbgsymbol.com/version https://dbgsymbol.com/version which as of the time of this posting, returns: "GetSymbol 2.0.3|https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe" the GetSymbol.exe file (which is downloadable right now) being presumably the infected file being discussed..!
- gregsadetsky 3y ago
  wow! all mirror repos (I found 5) have since been disabled :-) you can still see cached bits of the code via github search -> https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+%3B&type=code https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+... and a tiny bit of the repo's main page in google's cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fgithub.com%2Fdbgsymbol%2Fgetsymbol&oq=cache%3Ahttps%3A%2F%2Fgithub.com%2Fdbgsymbol%2Fgetsymbol&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg60gEHNzA5ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Ahttps... and the user's github profile, again from google's cache: https://webcache.googleusercontent.com/search?q=cache:JXXyoVWn_JgJ:https://github.com/dbgsymbol&cd=13&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:JXXyoV... the dbgsymbol.com links above still work, obviously.
  - account42 3y ago
    Github just erasing a repo and forks from existence is scarier than any potential malware that could have been included there. Not the first time they have done this - usually based on copyright accusations, but the reason does not matter - if you must use ShitHub, at least mirror your projects elsewhere folks.
nneonneo 3y ago
Yeah that’s what I’m referring to. IIRC it requires clicking/confirming a dialog to actually run the “update”, although I didn’t look that carefully before it got taken down.
NobodyNada 3y ago
There were also some binary DLLs in the repo (in the x64 directory) which get loaded/executed on first launch and then deleted. I didn’t reverse-engineer to see if there was anything malicious inside of them, but it seemed pretty fishy to me.

sillysaurusx 3y ago

Drat, archive.org didn't snag it. Do you happen to have a copy? https://web.archive.org/web/20230000000000*/https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp https://web.archive.org/web/20230000000000*/https://github.c...

gregsadetsky 3y ago
check https://github.com/bb33bb/getsymbol https://github.com/bb33bb/getsymbol and https://github.com/clayne/win-getsymbol https://github.com/clayne/win-getsymbol, two up to date forks -- and my comment above https://news.ycombinator.com/item?id=37425311 https://news.ycombinator.com/item?id=37425311

gregsadetsky 3y ago

Found these two forks which are still accessible (and are supposedly up to date with the upstream repo (linked in the comment above) which is not accessible anymore): https://github.com/bb33bb/getsymbol https://github.com/bb33bb/getsymbol https://github.com/clayne/win-getsymbol https://github.com/clayne/win-getsymbol here is the same link as in the comment above from one of the forks: https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMainDlg.cpp https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMai... the code fetches from `UPDATE_CHECK_URL`, which is hardcoded as: https://dbgsymbol.com/version https://dbgsymbol.com/version which as of the time of this posting, returns: "GetSymbol 2.0.3|https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe https://dbgsymbol.com/downloads/2.0.3/GetSymbol.exe" the GetSymbol.exe file (which is downloadable right now) being presumably the infected file being discussed..!

gregsadetsky 3y ago
wow! all mirror repos (I found 5) have since been disabled :-) you can still see cached bits of the code via github search -> https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+%3B&type=code https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+... and a tiny bit of the repo's main page in google's cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fgithub.com%2Fdbgsymbol%2Fgetsymbol&oq=cache%3Ahttps%3A%2F%2Fgithub.com%2Fdbgsymbol%2Fgetsymbol&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg60gEHNzA5ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Ahttps... and the user's github profile, again from google's cache: https://webcache.googleusercontent.com/search?q=cache:JXXyoVWn_JgJ:https://github.com/dbgsymbol&cd=13&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:JXXyoV... the dbgsymbol.com links above still work, obviously.
- account42 3y ago
  Github just erasing a repo and forks from existence is scarier than any potential malware that could have been included there. Not the first time they have done this - usually based on copyright accusations, but the reason does not matter - if you must use ShitHub, at least mirror your projects elsewhere folks.

nneonneo 3y ago

Yeah that’s what I’m referring to. IIRC it requires clicking/confirming a dialog to actually run the “update”, although I didn’t look that carefully before it got taken down.

NobodyNada 3y ago

There were also some binary DLLs in the repo (in the x64 directory) which get loaded/executed on first launch and then deleted. I didn’t reverse-engineer to see if there was anything malicious inside of them, but it seemed pretty fishy to me.