LetsDefend — Suspicious Browser Extension

Let’s run the ExtAnalysis tool.

And upload the extension file as well.

Which browser supports this extension?

On the Manifest.json file we can see a “Chrome” information.

Answer: Google Chrome

What is the name of the main file which contains metadata?

Answer: Manifest.json

How many js files are there? (Answer should be numerical)

On the files section we can see tah there are 2 js files.

Answer: 2

Download and install ExtAnalysis. Is the author of the extension known? (Yes/No)

Author is unknown.

Answer: no

Often there are URLs and domains in malicious extensions. Using ExtAnlaylsis, check the ‘URLs and Domains’ tab How many URLs & Domains are listed? (Answer should be numerical)

Answer: 2

Find the piece of code that uses an evasion technique. Analyse it, what type of systems is it attempting to evade?

On the thankyou.html file we can see an if statement that checks for any directory of different apps such as vmware and virtual box.

Answer: virtual machine

If this type of system is detected what function is triggered in its response?

If the if statement becomes true then chrome get’s terminated.

Answer: chrome.processes.terminate(0)

What keyword in a user visited URL will trigger the if condition statement in the code?

Let’s copy the code from content.js and let’s deobfuscate it.

Answer: login

Based on the analysis of the content.js, what type of malware is this?

On thedeobfuscated code there is a function called “onkeydown” so it does look like this code record keystrokes.

Answer: keylogger

Which domain/URL will data be sent to?

Let’s deobfuscate the code from background.js this time since there is a link on it.

Answer: https://google-analytics-cm.com/analytics-3032344.txt

As a remediation measure, what type of credential would you recommend all affected users to reset immediately?

I’d recommend users to change their password, since we know that the extension detects for any “login” and copies keystrokes from users. So it’s most likely taking usernames and passwords.

Answer: password