Deobfuscating Angel Drainer JS Kit

Transcript

all right thanks yeah we're going to be talking about the officiation uh of the agent drainer we got 20 slides to go over in 10 minutes so good luck to us all I'm Shahar uh I've been doing security for the past 15 years uh past three years at fireblocks where I lead the product security team uh we protect 200 million wallets for our 2,000 customers worldwide um and before jump in I also want to give a shout out to Matan from my team whose work has been the backbone of a lot of this presentation so hopefully you've heard about the engine drainer but if you

haven't it's one of the most notorious drainer kits out there uh it's been responsible for major losses over $20 million for hundreds of thousand thousands of uh victims and it also recently merged with its uh rival so it's just became stronger and more complex so when you look at that it's pretty obvious it's a it's an Ever evolving persistent threat in this industry so we should study it but when you you want to study the code you see that obfuscation is holding your back

and this what made us jump into this research and understand how it's working and how we can remove it so what's officiation alisation essentially is turning this piece of code into something that's really complex to understand uh to read and to get to the bottom line of why would you do that from a malare developer perspective from an ATT darkers perspective perspective you want to slow down you want to get uh uh resilience for your Mal so you want to make reverse engineering hard you want to slow down researchers you want to limit detection capabilities you want to

drain wallets at scale you want to make profit side note there are some some legitimate use cases for alisation like protecting your IP rights it's not all bad but this case it's really bad and want to tackle it so why decate what the exact opposite we want to make reverse engineering and debugging really easy we want to boost researchers we want to make uh uh our detections better we want to protect wallet scale and we want to present at DSS so in terms of goals for our research we have three goals here want to be able to understand the code so

want to be achieving Clarity removing all the applications and and and uh have the code easy to read but that's not enough we want to be able to also execute and debug the code because we do not believe in just static analysis and finally we want to leverage open source wherever possible because we don't have to recreate and reinvent the wheel so I'll start with the shout outs of projects that have been important for our work um couple first unminify and web crack are doing an amazing job with removing some of the application uh we had to build on top of that and I'll expand on this in a in a second so

unminify removes the minification of JavaScript code and web crack does some of the so jumping in looking at the angel uh JavaScript kit we see like any malware loader at the first stage is just loading a payload um it was minified code meaning had almost one half million characters in one line uh so we had to run it through on minifi and when we run

it through on minifi we got this um in the yellow box you can see the encoded payload this this is essentially compressed with XZ and then encoded in base 64 when s this is what it does so we did a reverse we uh uh decoded and then decompressed and we got this so this is as you can see it's a lot of code and you can maybe uh spot some uh computation going on which is a good sign for alisation and unpacking going on and you'd be correct after unpacking we see a code that's uh OB fiscated with opor doio which is a very

common JavaScript ofation uh um website it's protecting the core logic so we want to go uh uh and break it we tried a couple projects uh we saw that web crack did a way better job in terms of keeping the code debuggable so we can actually uh use it which is one of our uh goals here so we chose it and we got into this this is a code snippet out of 28,000 codes line of codes uh that we have and webar helped but we can still see some funny struct and some indirect relations between different parts of the code specifically we're going to

identify three players here which are going to beat one by one call them E D and W okay you can see on the on the green box where uh e is being defined uh is being called and defined on top and uh with d also some kind of indirect call to another function so first thing we did which allowed us to remove uh and simplify remove E from the equation was to use Babel transform the code into a and Abstract uh syntax tree which essentially again Pars in JavaScript looking at the code in a logical way it think about this as sort of a smart find and replace so whenever we see a a

menion we can just replace it with the direct uh code or the direct string and have the code way easier to understand now this is still the end goal would be a clear easy to understand JavaScript code and this is not it yet right we can see see some some funny things going on some numbers and the next Target is is D okay you can easily see that strings are missing right like within JavaScript code uh references to structs references to uh Json objects are doing by are dealt by strings and that's mying here so we realized this is a string uh

um mapping essentially and we try to reverse in generic now that was hard so instead we did some preprocess processing and then realize it may be easier to just run it so we created a standalone version of that function and run it through on a Sandbox environment as it should do with all malicious code uh we run it through the entire code and use the actual the unpacking function to remove that complexity you can see this is now way better way easier to understand but we still haven't gotten to our uh bottom line which is to get code that is as

clear as if you wrote it yourself but we are getting there and so the final route was to get both readability perfect readability and executability uh we the run around of as simplification after the the string fetching um which was like on Dynamic execution and finally in order to debug it we had another round final round of web crack which removed all the anti-debugging uh features they were present on the engine Runner which allows us to get to Discord which meaning after few weeks of work or 9 Minutes of uh presenting we

got to realize this is actually just closes the popup which is amazing um which kind of shows you the benefits of Opp getting the code from an A talker's perspective right it's we had to work really hard to get to a function that really doesn't do anything important but once we solved that we solved everything and now we can inspect the code we can debug it while it's being run and while it's being uh trying to drain us so because this is a research presentation summary and future work so we achieved uh executability and readability of the code like like we wanted to and if you want to dive in I

recommend first you'd look at angel X which is the latest version of the agent drainer um a good starting point is blockhead research which is up on their blog uh and also the onchain command and control mechanism that angel uses which leverages uh smart contract storage in a cool way um really recommended to dive in and that's it thank you uh for coming and listening you can find us on uh Twitter and in person [Applause]