WEEVILPROXYMalware
- JSCEAL
WEEVILPROXY is a sophisticated and featureful stealer which has a payload primarily written in NodeJS. The developer has put in concerted effort to develop the malware’s breadth of capabilities, including novel techniques not observed in any prior malware campaigns - to our knowledge.From MISP Galaxy
Last reported 25 days ago, by AhnLab ASEC2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1037.005Startup Items
“Check whether any automatic startup items using LaunchAgent were registered abnormally.”
- T1053.005Scheduled Task
“It then modifies the system’s security settings and registers scheduled tasks, while also creating a desktop shortcut to make it appear as if a legitimate cryptocurrency exchange program has been installed.”
- T1056.001Keylogging
“The deobfuscated output enabled detailed analysis of JSCeal’s capabilities and their implementation, including keylogging, browser and credential theft, and HTTPS traffic interception through a local MITM proxy.”
- T1110Brute Force
“This can be viewed as a bounded brute-force search.”
- T1564.003Hidden Window
“winpty-agent.exe – an agent for a hidden Windows console (open source)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Beware of Malware infection in Facebook Ads Offering Cryptocurrency Rewards“This time, a case was confirmed in which the Node.Js-based malware JSCEAL was distributed through Facebook ads impersonating a cryptocurrency exchange.”
-
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode“…ode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust).”
Indicators in its reports
named in the reports above- hxxps://github[.]com/hasherezade/jsc_deobfuscatorin 1 report
- e27ae65977287bdfb7b0e15fd3603f85in 1 report
- 03f4e47b9c2283c32bb8f8f042ce6e41in 1 report
- hxxps://accounts.google[.]com/o/android/auth?return_user_id=truein 1 report
- cursor[.]clickin 1 report
- console[.]infoin 1 report
- resources.live.ledger[.]appin 1 report
- 0d1fce0cb2b9dec26a10f0822aeffb19in 1 report
- 13.6.233[.]10in 1 report
- 581e2e2265d0c1509b3799c5a9039374in 1 report
- de10c6b3dc4619f59bc9c80a0aa15e6ain 1 report
- de213ebc44c614d0…2ee00e24e7b6in 1 report
- c77b3b7a507162bf…6a3c967b8d45in 1 report
- 0b8015cbb1ffdc6efe6a306ff5b1115fin 1 report
- 4757f3d26bc7110e…9b9b24e0b668in 1 report
- b90e3aaae14e7787…4f605860d2b8in 1 report
- 1026743185dfa10e9ddc21b5a4c578d5in 1 report
- 212d21ed1c4b5bd9…1891d584dca0in 1 report
- 55ee2359b12fbce9…3d6517b44437in 1 report
- 201f28b5e62e52e269757930f941c774in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.