Unraveling Cyber Threats: Insights from Code Analysis | FortiGuard Labs

Affected platforms: All platforms where PyPI packages can be installed
Impacted parties: Any individuals or institutions that have these malicious packages installed
Impact: Leak of credentials, sensitive information, etc.
Severity level: High

Vigilance is paramount in cybersecurity, especially when it comes to understanding and dissecting potentially malicious code. In this blog post, we’ll delve into a piece of code designed (discordpy_bypass-1.7 ) to extract sensitive data from user systems. We’ll analyze its components, functions, and methodologies to understand its purpose and approach.

Introduction

FortiGuard Labs uses a proprietary, AI-driven OSS malware detection system to hunt for and monitor threats. Using this approach on the Python Package Index (PyPI) supply chain platform, we unearthed a malicious PyPI package named discordpy_bypass-1.7, published on March 10, 2024, and detected on March 12, 2024.

This code aims to covertly extract sensitive information from unsuspecting victims using a blend of persistence techniques, browser data extraction, and token harvesting. Understanding the origins and propagation methods of malicious code is paramount in its analysis. Authored by theaos, the author produced seven versions of the package, including versions 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, and 1.7. The upgrade-colored_0.0.1 also exhibits similar malicious content as discordpy_bypass, indicating a consistent behavior pattern across versions.

“discordpy_bypass-1.7” highlights the sort of ongoing threats seen across the cybersecurity landscape. This PyPI package version exhibits similar malicious behavior to previous malicious packages, focusing on extracting sensitive data from user systems through obfuscated code and evasion techniques targeting analysis environments. The code employs various checks to detect debugging or analysis environments and terminates itself if detected, showcasing the author’s effort to evade scrutiny.

The code has three layers. The original Python code is encoded using base64 (the innermost layer). The encoded strings are then broken into separate pieces and encoded once again with some obfuscation techniques (intermediate layer). The obfuscated file is then compiled using pyinstaller into an exe (the last layer) put on a remote URL. The code in discordpy_bypass/discordpy_bypass.py fetches the code from the URL and runs it on the user’s device. This underscores the critical need for vigilance and proactive measures to effectively detect and mitigate cybersecurity threats.

Detecting Debugging or Analysis Environment

One of the first lines of defense code developers use against reverse engineering is detecting debugging or analysis environments. The code segment employs multiple techniques, listed below, to identify such environments and terminate the program’s “self-destruct” if detected.

Block listed Processes: These iterate over the running processes and terminates them if their names match those in the blocked process list (“blacklistedProcesses”). These processes include debugging tools like Wireshark, OllyDbg, and IDA64

Network-related Checks: Compares system IP and MAC addresses against block lists (“blackListedIPS”, “blackListedMacs”). If the IP or MAC address is found in a block list, it returns “True,” indicating a debugging environment.

System-related Checks: Compares system username, hostname, and hardware ID against block lists. (“blackListedUsers,” “blackListedPCNames,” and “blackListedHWIDS”)

System Initialization and Socket.IO Events

The code initializes a number of variables and sets up Socket.IO events to handle connections, disconnections, frame adjustments, and more. It enables remote control and monitoring of a system, facilitating actions such as directory navigation, file operations, and command execution.

Command Handling Functions

Several functions handle commands received over Socket.IO, executing various actions based on the command received. These actions include listing directory contents, sending files to the server, displaying alerts, listing processes, terminating processes, gathering system information, and more.

Malicious Intent

Browser Data Extraction and Token Harvesting: The code’s core functionality revolves around extracting sensitive information from browsers and harvesting authentication tokens, particularly from Discord.

Browser Data Extraction: It utilizes techniques to extract data such as login credentials, cookies, web history, and more from various browsers.

Token Harvesting: This process also decrypts and validates authentication tokens extracted from files, particularly Discord tokens, before uploading them to a remote server.