sysopfb

b2aa52f6a09022524c8bd2b8411e3b5d7eab8f190300f84ff6ec11464568c96c

Has an onboard python project that is obfuscated

after deobfuscating it appears to be some kind of a backdoor/loader type bot that has an onboard config and retrieves the next hop from the ethereum blockchain,

Config:

    _cfg = AgentConfig(server_url="http://127.0.0.1:8000", token="320473d40b7b18dc9fd3820bd48a55bf15806f835cb79b87f751a3b167534011", transport_mode="dns", dns_server_ip="127.0.0.1", dns_port=53, contract_address="0x5d04ed162c548fc4508cbb59266b02afbaf3ebc1", rpc_endpoints="https://eth.llamarpc.com,https://ethereum-rpc.publicnode.com,https://eth.drpc.org,https://rpc.eth.gateway.fm,https://eth-mainnet.public.blastapi.io,https://gateway.tenderly.co/public/mainnet,https://ethereum.rpc.subquery.network/public,https://eth.api.onfinality.io/public,https://rpc.sentio.xyz/mainnet,https://eth.merkle.io", blockchain_key="320473d40b7b18dc9fd3820bd48a55bf15806f835cb79b87f751a3b167534011", hardcoded_ip="", get_data_selector="1dcf296b")

#Malware related RMMSystem that uses Metastealer C2 traffic, tracker traffic: /pmxs/logs

"""
Full DGA (Domain Generation Algorithm) replication of sub_14000BF00 and friends.

Calling generate_domains() replicates the exact output of the binary with the
hardcoded seed, count, width, and word list found in sub_14000BF00.
"""

Decoded base64 with the 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=' alphabet

noPax
latest
listNamespaces
packages
setupGitHubSender
html_url
state
addTarEntry

Not sure if this is victim related data or what

   "NewTabPage": {
        "PrevNavigationTime": "13292560510726665"
    }, 
    "gaia_cookie": {
        "hash": "2gW6ZW+guv8Us/fjpeX7conzXoo=", 
        "last_list_accounts_data": "[\"gaia.l.a.r\",[[\"gaia.l.a\",1,\"Sang Hyun Lee\",\"leesh65@gmail.com\",\"https://lh3.googleusercontent.com/-daipoVZf-r8/AAAAAAAAAAI/AAAAAAAAAAA/TagFXSnGLoE/s48-c/photo.jpg\",1,1,0,null,1,\"100934410837439495113\",null,null,null,null,1]]]", 
        "changed_time": 1640301806.63822

Blobs in lockbit black are decoded similar to BlackMatter but with a new LCG based on 64 bit

The init seed for the sample I REd was at the start of .pdata

POC decoding, pretty quick and dirty due to time constraints

def mul64(a1, a2):
    return(a1 * a2)

New samples: https://www.proofpoint.com/us/blog/threat-insight/whatta-ta-ta505-ramps-activity-delivers-new-flawedgrace-variant

Ascii strings are double XORd, one hardcoded key 0x40 bytes and one single byte

 -nm
TestStarter.exe
TestService.exe

	#Saw RussianPandas ida script after I got it to the custom base64 - was easy to verify my work after finding their IDA script
	# Prior work ref: https://github.com/RussianPanda95/IDAPython/blob/main/Atomic%20Stealer/amos_config_extract_idapython-3-2025.py
	# created a standalone decoder based on the x64 opcodes
	import re
	import sys
	import yara
	import struct
	import binascii
	import base64
	rule_source = '''

	#stager 1 versions (sxor_3)
	def decode_data4(data):
	key = hashlib.sha1(b'bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN').digest()
	rc4 = ARC4.new(key)
	t = rc4.decrypt(data)
	tt = qbot_helpers.qbot_decode(t[20:])
	return(tt)

	#qbot_decode is just the oldschool decode of qbots:
	def qbot_decode(data):

	# Rekall Memory Forensics
	# Copyright 2014 Google Inc. All Rights Reserved.
	#
	# Author: Michael Cohen scudette@google.com.
	#
	# This program is free software; you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation; either version 2 of the License, or (at
	# your option) any later version.
	#

	2aaebf0282463c60aa8866e733799eee97f41af1e3ac8ae7855279595217aa2f

	SnapITool.zip

	```
	https://vzhqu.snapitool.com/SnapITool.zip

	```

	```