Hexacorn

Old Flame Never Dies (a.k.a. decompiling LUA)

September 26, 2016 in Batch Analysis, File Formats ZOO, Malware Analysis, Reversing

When the news about Flame exploded all over the media, I remember grabbing available samples and like many other researchers started poking around. Pretty quickly, I extracted a large number of very unique strings from various Flame samples and posted them online.

Recently, I accidentally came across that old post and started wondering if anyone ever posted the decompiled Lua scripts for the malware. I googled around for some of the strings I posted on my blog back then and to my surprise – my blog was the only one showing up!

I guess there must be some conspiracy theory that will explain that…

Back in 2012, I didn’t have all the samples, but I did run them through a quick analysis process which I will describe below. The procedure for obtaining the strings was extremely crude, but like many quick&dirty solutions – it worked pretty well (and it was fast!).

For each DLL, load it via rundll32
- For each exported function, execute it
  - For ever every single execution, delay for some time
  - Grab memory dumps for rundll32
  - Kill rundll32

Interestingly, I still have the memory dumps I used to extract the strings from, so… since I suddenly thought of these Lua scripts I re-used the memdumps to extract over 60 Lua bytecoded scripts (from both static files and memory dumps to be precise).

And here comes the real purpose of the thread – document how to obtain decompiled Lua scripts from Flame:

I wrote a quick carving tool in perl to extract Lua bytecode from both static files, and memory dumps
- This was pretty easy, since the compiled Lua always starts with a header “\x1BLua”
- For each extracted file, I wrote another quick&dirty script to rename it to the name embedded inside the bytecoded Lua script
- That’s how we get the ‘original’ name of the files f.ex. ‘MUNCH_ATTACKED_ACTION.lua’ is embedded inside the bytecoded Lua script