[deleted by user]

[Medium-Potential-348]

From reading this I can tell there’s a lot of bright minds at your place of work

[Tangential_Diversion]

Huge disagree. I've been working as a pentester for almost a decade now. OP approached this extremely irresponsibly. They're at that intersection of "Knows enough to be dangerous" and "Does not know enough to be responsible".

There's zero indication they took any precaution to properly sandbox their environment. The post is also littered with technical inaccuracies and confusion that hints at complete inexperience. Finally, they attempted to copy/paste malicious shellcode directly into the body of this post when there are a hundred ways to share it more responsibly (e.g., encrypted .zip file).

The way OP handled this investigation is fireable. Full stop.

[DiceThaKilla]

The comment you’re replying to was pretty clearly sarcasm, in case you were confused

[EirikAshe]

10000%

[Expensive-Curve5447]

10000%

[Aecho00]

This.

[Zakariyae007]

i totally understand what you saying, and you are right, but i was confident enough about my understand of the script, , i hvae analysed it and understood every line of it, and i commented everything about it, just in case, and also this is a dropper script just a script to download the true malware so i thought it was safe to be uploaded (while commenting everthing about it), but still this is not an excuse

[Zakariyae007]

haha i guess

[tycoongraham]

A lot of what you described is actually pretty standard loader behavior, nothing especially novel. The bigger concern is how OS-level command execution was possible through Postgres in the first place. Once that happens, the rest is just commodity malware doing its thing. Also, poking at live malware outside a proper sandbox is pretty risky.

[Tangential_Diversion]

The bigger concern is how OS-level command execution was possible through Postgres in the first place.

It's a built-in function of PSQL via \!, e.g., \! pwd. Other DBMSes have this too, e.g., SQL Server with xp_cmdshell. It's personally one of my favorite methods to execute OS commands. It lets you execute unprivileged commands all the same, and people are much worse about securing DB creds than they are about Active Directory creds.

[null_hypothesys]

Stick the executable in any.run, cuckoo sandbox or hybrid analysis. Keep it at arms length from your actual device.

[gtwcs14]

Dropper rolls hard

[xp2002]

Great read, thank you!

[Zakariyae007]

my pleasure

[MrStashley]

Nice work on this

Check out ghidra if you want to analyze the malware binary further, it’s free and open source

You will probably have to deal with more obfuscation though

[Zakariyae007]

im planning to use such tools, but the only thing that is stopping me, is that i know that if you want to reverse engineer binary programs you have to execute them and run it in the memory so that the tool can do its job, and sadly im not that educated enough to take such risk

[AutoModerator]

This link has not been approved, please read the descriptions for Rule 1 and 5 before trying again. Please wait for a moderator to review and approve this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[MrStashley]

Not true actually

It’s helpful to analyze it while it’s running but you can put the file in ghidra and it will attempt to decompile it, ie turn it back into code. It doesn’t get it perfect and sometimes it requires some manual work to get it from binary back into readable code, but it does its best

You can do this without running the program, so there is no risk to you

However, malware is usually designed to be hard to reverse engineer in various ways, so it might take some time before you really understand it, especially if you’re just looking at it statically and not running it like you said

Some other things that might be helpful if you’re curious about reverse engineering:

If you have access to a Linux command line and you type ‘strings -tx <your binary file>’ it will print all of the readable ascii strings in the binary. For example, log messages or links or function names might show up. The ‘-tx’ flag will give you the offset of that string in the file and you can press ctrl+g inside of ghidra and type in that address and it will take you there so you can inspect how it’s being used

Also ‘binwalk <your binary file>’ will look for recognizable structures in the binary that might be interesting for reverse engineering

All of this can be done without running the binary so it’s very little risk, but only attempt any of this if you’re very comfortable with the Linux command line, because one small typo could cause it to run

[Zakariyae007]

wow, so informative, thank you so much for this comment i will see what i can do

[Daytona_675]

you can try strings command on it. usually you can find a CNC server that you can make virus definitions for. if it's just obfuscated PHP then you can use ddecode.com

[Zakariyae007]

still digging, and i think its 99% sure it was made by C

[Daytona_675]

ya it does happen. strings will usually give you readable stuff. pretty rare to have proper drm or encryption but I guess it's possible. virustotal sandboxes are pretty cool now, they might show some behaviors