MALWARE on GitHub | `Cracked Software` Reverse Engineering via Debugging, FLOSS, and API monitoring

Опубликовано: 09 Апрель 2026
на канале: Jai Minton - CyberRaiju

2,679

126

Analysis of a RAR file which leads to the discovery of malicious Github repositories designed to distribute LummaC2 information stealer.

Note: The malicious repository has been removed shortly after the video was published, well done GitHub. 👏

** Find me at **
Twitter/X - / cyberraiju
Blog - https://www.jaiminton.com/
Mastodon - https://infosec.exchange/@CyberRaiju

** Tools **
FLARE VM - https://github.com/mandiant/flare-vm
Detect-It-Easy - https://github.com/horsicq/Detect-It-...
x64dbg - https://x64dbg.com/
FakeNet-NG - https://github.com/mandiant/flare-fak...
Process Hacker - https://processhacker.sourceforge.io/
APIMonitor - http://www.rohitab.com/apimonitor
ScyllaHide - https://github.com/x64dbg/ScyllaHide
Scylla - https://github.com/NtQuery/Scylla
PE-Bear - https://github.com/hasherezade/pe-bear

** Sample **
https://bazaar.abuse.ch/sample/24fde1...

** Malicious Github Repositories **
https://github[.]com/crossundefinedhans/TurboTax-activation-by-leur?tab=readme-ov-file
https://github[.]com/witch12138/test/releases/tag/lat

** Further Reading **
https://learn.microsoft.com/en-us/pre...
https://learn.microsoft.com/en-us/pow...
https://learn.microsoft.com/en-us/dot...
https://outpost24.com/blog/everything...
https://cyble.com/blog/lummac2-steale...

** Timestamps **
00:00 - Intro
00:27 - Malicious Github repository analysis
01:50 - Comparing metadata of version 1.8.2 and 1.8.4 installers
02:52 - Comparing imported APIs
03:40 - Identifying process injection via APIs
04:52 - Methods for identifying new processes
05:30 - CimIndication Events with PowerShell
06:15 - Failure: DoS when using CimIndication events
07:05 - Fields exposed with CimIndication events
08:15 - Monitoring processes run
08:56 - Dynamic analysis of malware
10:45 - Identifying architecture of executables
11:12 - Debugging malware 1
11:30 - Creating breakpoints on malware 1
12:08 - Running malware 1
12:48 - Dumping injected process with Scylla
14:05 - Running dumped payload 1
14:32 - Network analysis of payload 1
14:55 - Using FLOSS on payload 1
16:45 - Debugging malware 2
17:08 - Creating breakpoints on malware 2
18:16 - BitLockerToGo.exe running
21:12 - Dumping injected malware 2
22:22 - Running dumped payload 2
22:43 - Using FLOSS on payload 2
23:34 - Monitoring API calls
25:49 - Locating C2 endpoints via API calls
26:55 - Outro

Credits:
SFX by Pixabay

** CimIndicationEvent Script **
```
Get-EventSubscriber -SourceIdentifier "ProcessStarted" | Unregister-Event
$action = {
$name = $event.SourceEventArgs.NewEvent.ProcessName
$id = $event.SourceEventArgs.NewEvent.ProcessId
$parent = $event.SourceEventArgs.NewEvent.ParentProcessID
$CMD=(Get-CimInstance -ClassName Win32_Process| ? {$_.ProcessId -eq $event.SourceEventArgs.newevent.processID} | Select -exp CommandLine)
$Parentname=(Get-CimInstance -ClassName Win32_Process| ? {$_.ProcessId -eq $event.SourceEventArgs.newevent.ParentProcessID} | Select -exp CommandLine)
Write-Host "New Process Started : $parentname | $parent | $name | $id | $CMD"
}
Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -Action $action
```