Category Archives: Compromise Detection

DeXRAY

Posted on by

DeXRAY is a private tool that turned public a few years ago. Back in a day it helped me to decrypt some Quarantine files from forensic cases I worked on. Over time I expanded it to cover more engines and file formats. Not all the decryptions work perfectly, but as usual – this is a work in progress. Also, because I add stuff ad hoc, it’s not a beautiful code either. But it works 🙂

At the moment Dexray supports quarantine files and logs from a number of AVs, and data files storing PE files in an encrypted form (XOR with a single byte key). The full list of supported or recognized file formats is listed below:

  • ASquared (EQF)
  • ESET (NQF)
  • Kaspersky (KLQ) – based on the code by Optiv
  • MalwareBytes Data files (DATA)
  • MalwareBytes Quarantine files (QUAR)
  • McAfee Quarantine files (BUP) – not perfect, but it should still help
  • Microsoft Forefront (Magic@0=0B AD) – not handled yet; only recognized
  • SUPERAntiSpyware (SDB)
  • Symantec Quarantine Data files (QBD)
  • Symantec Quarantine files (VBN) – not perfect, but it should still help
  • Symantec Quarantine Index files (QBI)
  • TrendMicro (Magic@0=A9 AC BD A7 which is ‘VSBX’ string ^ 0xFF) – based on the code by Optiv
  • Any binary file (using X-RAY scanning)

Now, it is a buggy program. I know of it so please bear with me. If you find something not working, or stupid, please tell me 🙂

Also, if you have any Quarantine files that you can share, from any AV, please send them over. I will appreciate it as it will help me to add new engines and test the support for already implemented ones. Thanks!

Note: I used the code from Optiv to implement decryption of Kaspersky and Trend. This is a good stuff. Thanks to that – apart from decryption of the malware – DeXRAY now dumps additional metadata extracted from these two Quarantine file types. The metadata is stored in dedicated files with the .met extension, and is also printed to STDERR.

Here is an example for Kaspersky:

kav

And for Trend:

trend

The output files are saved into the following files:

  • .out – the decrypted data
  • .met – metadata (Trend&Kaspersky only)

In some cases you may find more than one .out file created for a given input files. This is the case with Trend Micro Quarantine files.

  • The first is:
    • <filename>.TREND1.out file
      and contains a decrypted input file which includes both metadata and the file content
  • The second is:
    • <filename>TREND2.out
      that contains the actual file you want to analyze.

Another case like that is if the binary blob contains more than one encrypted PE file which is decrypted using X-Rays algorithm (basically, a number of PE files encrypted using a single byte XOR key inside one blob/file).

The script can be downloaded here.

 

Beyond good ol’ Run key, Part 36

Posted on by

Last Updated 2023-02-25

Added xdbg32 from Trend Micro article.

Last Updated 2019-09-20

A few more updates thanks to @bartblaze !!!

Last Updated 2018-10-18

Updated mistake in tplcdclr.exe –> wtsapi32.dll –>wts.chm combo and added VeetlePlayer.exe –> libvlc.dll –>mtcReport.ktc; thanks to @KyleHanslovan !!!

Last Updated 2017-01-26

At the end of last post I mentioned PlugX. The idea used by this malware is pretty clever and relies on taking a legitimate signed .exe that is dependent on a DLL and swapping the DLL with the malicious replacement which – when loaded – decrypts/loads the final payload to memory.  The trick used by PlugX is referred to as DLL Side-loading and I thought it will be nice to try summarizing various versions of this persistence trick described by various blogs.

The below are triplets describing the following PlugX components:

  • legitimate .exe [‘Source’ refers to the article/blog/WP describing it]
    • DLL Side-loaded .dll
      • Payload

Here they are…

There is also a potential combo:

  • AFLogVw.exe [Source]
    • AhnI2.dll
      • <unknown>

Now, a request – if you know any other combo that I have not included on the list, please let me know+provide a reference/source and I will add it to the list. Thanks!