Cybercriminals disguise themselves as interviewers and send candidates a ZIP archive named (onlinestoreforhirog.zip) as part of a fraudulent interview process. This archive contains genuine files alongside a harmful JavaScript file (printfulRoute.js), which is intentionally obfuscated to avoid detection.
The obfuscation techniques used include base64 encoding, dynamically generated function names, and string concatenation to conceal the script’s true intent. Once the code is deobfuscated, it reveals a command-and-control (C2) address (http://67.203.7[.]171:1244) and its capability to execute malicious operations.
The main function of the script adapts its data extraction methods based on the operating system of the target before managing the data transmission. The C2 communication module constructs HTTP POST requests to a designated server, embedding system information, a unique host identifier, timestamps, and the extracted data. This data, formatted as form data, includes details such as hostname, platform, and data type identifiers.
The malware uses a function called “rt” to download additional payloads, constructing URLs and employing curl to fetch files to a temporary location. It retries the download until a set condition is met or the file size requirements are satisfied. Once downloaded, the file is extracted, and a Python script named “.npl” is saved in the user’s home directory. This script then downloads another Python script named “pay,” which contains highly obfuscated code.
Deobfuscating the “pay” script reveals a sophisticated malware capable of detailed system information gathering, geolocation retrieval, command execution, and user activity monitoring through keylogging and clipboard capturing. This malware, known as DEV#POPPER, has evolved to include Remote Monitoring and Management (RMM) features for persistent infection via Anydesk, circumventing antivirus detection.
The malware’s data exfiltration capabilities have advanced, now supporting recursive file searches, filtering, and FTP uploads, including binary transfers and data obfuscation, which enhances its automation and stealth.
The Python script employs advanced obfuscation techniques such as directory traversal and filtering to obscure its functionality and impede analysis. It includes multiple obfuscated components named ld, ld0, ld1, and ld2, which complicate code interpretation and detection.
This more sophisticated version of the malware can perform targeted geolocation data collection and refined system information gathering, indicating a higher level of sophistication and malicious intent.
After compromising a host, attackers used a Python backdoor to access browser cookies stored in Chrome extensions by attempting to download a known cookie script (browser_cookie3), though initial dependency issues were encountered. Once these issues were resolved, the malware successfully exfiltrated browser data and system information, sent periodic heartbeats, and retrieved additional payloads from the C2 server (67.203.7.171:1244) for execution.
According to Securonix, a malicious Python script, downloaded from a remote server, is designed to extract sensitive information from various web browsers across different operating systems. This malware employs obfuscation and a class-based architecture to adapt dynamically to the target system’s OS, executing specific modules to extract browser credentials from browsers like Chrome, Opera, and Brave.
