The developers attacked through fake packages at once in two popular repositories. The attackers placed 16 malicious libraries in RubyGems and another 37 in npm, picking up names with typos for known dependencies. Installation of bait on Windows launched StubMaker, a data snatch that collected passwords and active browser sessions, bank card information, cryptocurrency wallets, sid phrases and Telegram Desktop files. Analysis of both series showed the overall infrastructure, the same bootloader and the same main malicious module.
The first part of the campaign was found on August 15 in RubyGems. Used for distribution Typskvotting: the attacker registers a package with a name very similar to the name of the popular library and counts on the developer error when entering the installation command or selecting the dependency. With StubMaker 16 names were associated: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler and brundlef. The names were mimicked by Bundler, i18n, Rake and Active Support.
The authors of the campaign used the feature of RubyGems, which allows to re-occupy the released name of the package. At least brumdler and brundlef first published from one account, then deleted, after which the names were transferred to other accounts of intruders. If all gem versions are deleted and the name is again available for registration, the other user has the right to occupy it. Therefore, the removal of the malicious library does not necessarily permanently close the former name.
Another technique helped mask the connection between the packages. In the RubyGem field specification authors contains ordinary text and does not serve as a confirmed identification record of the owner. The author of the package can specify a name there that does not match the account used for publication. The attackers prescribed different names of the authors from several libraries, although they downloaded the packages through the same accounts. The official RubyGems documentation really describes authors as a metadata field in the gem specification, along with the name, version, description and email address.
The malicious code was launched during the installation of the Ruby package. A file was used to run extconf.rb, designed to prepare native extensions. RubyGems usually performs extconf.rb, to check for the necessary functions and libraries and form a Makefile for the subsequent extension build. The official management of RubyGems explicitly describes such a scheme of work.
StubMaker replaced the normal assembly with a fictitious one. extconf.rb created Makefile with empty goals all, install and clean, as well as plugs for Unix and Windows. The scripts did not compile the useful component, but simply ended without an error, so RubyGems received a message about a successful build. In parallel, the installer defined the operating system and ran a malicious chain. The name StubMaker is connected exactly with the creation of such plugs, which hid the real work of the installation scenario.
On Windows Ruby-code downloaded from GitHub a file of about 22 MB. The address was pre-hidden with Base64. Obtained main.exe contained a bootloader on Rust, inside of which was an encrypted executable module measuring approximately 11 MB, written in Go. It was not necessary to download the main styler separately: the bootloader decrypted the built-in PE file, checked the signature MZ, found the necessary Windows functions and placed the program in memory.
The main module designated as wincfg, hunted primarily for the data of browsers based on Chromium. The list of targets included Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex Browser, Avast Secure Browser, AVG Secure Browser and CCleaner Browser. The malware searched for saved credentials, cookies and tokens of active sessions, history of visits, information of extensions and payment card numbers.
To access secure data browsers, StubMaker used DLL abe_payload.dll. The library helped to circumvent the protection of the App-Bound Encryption, in Russian it can be called encryption with binding to the application. Google applies mechanism ABE in Chrome to complicate the theft of local secrets by another Windows process. Protected keys are linked to an application that is allowed to decrypt. StubMaker implemented its own DLL in the browser process and tried to get the necessary data from the trusted context. Google confirms the use of the App-Bound Encryption as a means of protecting against the theft of browser data by malware.
Cryptocurrency data collected a separate set of functions. The code searched for software wallets and browser extensions MetaMask, Coinbase Wallet, Phantom, Solflare, Exodus, Electrum, Bitcoin, Litecoin, Dogecoin, Monero, Atomic, Guarda and Trezor Suite. Additionally, the styler viewed text and JSON files in search of sequences similar to recovery phrases and checked the found words with the BIP-39 dictionary. The results were recorded in files wallets.txt and seeds.txt. The mechanism of automatic translation of cryptocurrencies researchers in samples did not find. StubMaker stole data that allowed access to the wallet later.
Telegram Desktop was also included in the list of goals. Styler was looking for a catalog tdata, where the client stores local session data, and checked the standard installation paths of the program. At the same time, the malware collected the Windows username, computer name, operating system version, processor and graphics card information, RAM and public IP address. The service was used to determine the external address api.ipify.org.
The collected StubMaker files were packed in a ZIP archive with a password and sent to Gofile. After downloading, the malware received a link to the archive and transmitted the address to the operator through dresslee.com on unencrypted HTTP. Together with the link, a summary of the infected computer and the number of passwords, cookies, history records and cryptocurrency data found was published. The samples studied did not attempt to gain a foothold through Windows services, task scheduler, autostart keys, or Startup folder. The campaign was designed to steal information immediately after the contamination of the addiction.
The second part of StubMaker was discovered the next day. On August 16, 37 packages appeared in npm with names similar to Axios, Chalk, Commander, Lodash, TypeScript and React. Legitimate projects did not hack: the attackers published independent Double Packs. Among the examples — axois-http, chalk-core, comander-cli, loadashjs, typescirpt-cli and raectjs. The authors changed the order of letters, passed symbols and added endings -core, -lib or -cli, so that the name can be taken for the auxiliary library of the famous project.
All 37 npm packets got the version 1.0.0 and contained almost the same malicious scenario postinstall.js. npm automatically executes scripts postinstall after installing the package, so the developer did not need to import the library or run a separate function. It was enough to establish dependence.
The initial steps for RubyGems and npm differed. Ruby option used extconf.rb and kept the downloader address in the Base64 line. the npm option was launched through postinstall and hid the address with an XOR with a repeating rigidly specified key. After decrypting the address, both chains moved to the same bootloader for Windows.
npm packages also took into account Windows Subsystem for Linux. Conventional Linux and macOS could not run a Windows PE file, however, WSL was processed separately. The installation script was accessed from the Linux environment to Windows powershell.exe, downloaded main.exe and started the bootloader already on the main system. Therefore, the work inside the WSL did not protect the developer from the Windows version of StubMaker.
RubyGems and npm differed markedly in the speed of publication of malicious packages. Ruby libraries appeared consecutively for two days: after the removal of one batch, the operator changed the account and continued the publication. The main group npm was downloaded in about eight minutes through five accounts. The distribution of packages between multiple time profiles reduced the campaign’s dependence on a single account, although npm quickly discovered and deleted the entire group.
The shared server finally linked two series of attacks. RubyGems and npm sent data to 193.70.34.101:20099/vote, addressed one GitHub Release for main.exe and received a file with the same SHA-256 hash. Inside the bootloader was an identical Go-styler. One operator, therefore, simultaneously distributed one malware through two package ecosystems.
There was no self-distribution in StubMaker. The malware did not infect legitimate libraries, did not capture their developers’ accounts, and did not publish copies on its own. For compromise, it was necessary to install one of the bait packages on Windows or in WSL.
By the time of publication, the discovered packages were removed from RubyGems and npm, and the GitHub account from which the bootloader was downloaded was not available. Computers where malicious dependence has managed to be installed, it is recommended to isolate, complete active browser and Telegram sessions and change passwords from another trusted device. When storing sid phrases on an infected computer, it is safer to consider the corresponding cryptocurrency wallets compromised and transfer funds to new addresses created in a clean environment.
The first part of the campaign was found on August 15 in RubyGems. Used for distribution Typskvotting: the attacker registers a package with a name very similar to the name of the popular library and counts on the developer error when entering the installation command or selecting the dependency. With StubMaker 16 names were associated: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler and brundlef. The names were mimicked by Bundler, i18n, Rake and Active Support.
The authors of the campaign used the feature of RubyGems, which allows to re-occupy the released name of the package. At least brumdler and brundlef first published from one account, then deleted, after which the names were transferred to other accounts of intruders. If all gem versions are deleted and the name is again available for registration, the other user has the right to occupy it. Therefore, the removal of the malicious library does not necessarily permanently close the former name.
Another technique helped mask the connection between the packages. In the RubyGem field specification authors contains ordinary text and does not serve as a confirmed identification record of the owner. The author of the package can specify a name there that does not match the account used for publication. The attackers prescribed different names of the authors from several libraries, although they downloaded the packages through the same accounts. The official RubyGems documentation really describes authors as a metadata field in the gem specification, along with the name, version, description and email address.
The malicious code was launched during the installation of the Ruby package. A file was used to run extconf.rb, designed to prepare native extensions. RubyGems usually performs extconf.rb, to check for the necessary functions and libraries and form a Makefile for the subsequent extension build. The official management of RubyGems explicitly describes such a scheme of work.
StubMaker replaced the normal assembly with a fictitious one. extconf.rb created Makefile with empty goals all, install and clean, as well as plugs for Unix and Windows. The scripts did not compile the useful component, but simply ended without an error, so RubyGems received a message about a successful build. In parallel, the installer defined the operating system and ran a malicious chain. The name StubMaker is connected exactly with the creation of such plugs, which hid the real work of the installation scenario.
On Windows Ruby-code downloaded from GitHub a file of about 22 MB. The address was pre-hidden with Base64. Obtained main.exe contained a bootloader on Rust, inside of which was an encrypted executable module measuring approximately 11 MB, written in Go. It was not necessary to download the main styler separately: the bootloader decrypted the built-in PE file, checked the signature MZ, found the necessary Windows functions and placed the program in memory.
The main module designated as wincfg, hunted primarily for the data of browsers based on Chromium. The list of targets included Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex Browser, Avast Secure Browser, AVG Secure Browser and CCleaner Browser. The malware searched for saved credentials, cookies and tokens of active sessions, history of visits, information of extensions and payment card numbers.
To access secure data browsers, StubMaker used DLL abe_payload.dll. The library helped to circumvent the protection of the App-Bound Encryption, in Russian it can be called encryption with binding to the application. Google applies mechanism ABE in Chrome to complicate the theft of local secrets by another Windows process. Protected keys are linked to an application that is allowed to decrypt. StubMaker implemented its own DLL in the browser process and tried to get the necessary data from the trusted context. Google confirms the use of the App-Bound Encryption as a means of protecting against the theft of browser data by malware.
Cryptocurrency data collected a separate set of functions. The code searched for software wallets and browser extensions MetaMask, Coinbase Wallet, Phantom, Solflare, Exodus, Electrum, Bitcoin, Litecoin, Dogecoin, Monero, Atomic, Guarda and Trezor Suite. Additionally, the styler viewed text and JSON files in search of sequences similar to recovery phrases and checked the found words with the BIP-39 dictionary. The results were recorded in files wallets.txt and seeds.txt. The mechanism of automatic translation of cryptocurrencies researchers in samples did not find. StubMaker stole data that allowed access to the wallet later.
Telegram Desktop was also included in the list of goals. Styler was looking for a catalog tdata, where the client stores local session data, and checked the standard installation paths of the program. At the same time, the malware collected the Windows username, computer name, operating system version, processor and graphics card information, RAM and public IP address. The service was used to determine the external address api.ipify.org.
The collected StubMaker files were packed in a ZIP archive with a password and sent to Gofile. After downloading, the malware received a link to the archive and transmitted the address to the operator through dresslee.com on unencrypted HTTP. Together with the link, a summary of the infected computer and the number of passwords, cookies, history records and cryptocurrency data found was published. The samples studied did not attempt to gain a foothold through Windows services, task scheduler, autostart keys, or Startup folder. The campaign was designed to steal information immediately after the contamination of the addiction.
The second part of StubMaker was discovered the next day. On August 16, 37 packages appeared in npm with names similar to Axios, Chalk, Commander, Lodash, TypeScript and React. Legitimate projects did not hack: the attackers published independent Double Packs. Among the examples — axois-http, chalk-core, comander-cli, loadashjs, typescirpt-cli and raectjs. The authors changed the order of letters, passed symbols and added endings -core, -lib or -cli, so that the name can be taken for the auxiliary library of the famous project.
All 37 npm packets got the version 1.0.0 and contained almost the same malicious scenario postinstall.js. npm automatically executes scripts postinstall after installing the package, so the developer did not need to import the library or run a separate function. It was enough to establish dependence.
The initial steps for RubyGems and npm differed. Ruby option used extconf.rb and kept the downloader address in the Base64 line. the npm option was launched through postinstall and hid the address with an XOR with a repeating rigidly specified key. After decrypting the address, both chains moved to the same bootloader for Windows.
npm packages also took into account Windows Subsystem for Linux. Conventional Linux and macOS could not run a Windows PE file, however, WSL was processed separately. The installation script was accessed from the Linux environment to Windows powershell.exe, downloaded main.exe and started the bootloader already on the main system. Therefore, the work inside the WSL did not protect the developer from the Windows version of StubMaker.
RubyGems and npm differed markedly in the speed of publication of malicious packages. Ruby libraries appeared consecutively for two days: after the removal of one batch, the operator changed the account and continued the publication. The main group npm was downloaded in about eight minutes through five accounts. The distribution of packages between multiple time profiles reduced the campaign’s dependence on a single account, although npm quickly discovered and deleted the entire group.
The shared server finally linked two series of attacks. RubyGems and npm sent data to 193.70.34.101:20099/vote, addressed one GitHub Release for main.exe and received a file with the same SHA-256 hash. Inside the bootloader was an identical Go-styler. One operator, therefore, simultaneously distributed one malware through two package ecosystems.
There was no self-distribution in StubMaker. The malware did not infect legitimate libraries, did not capture their developers’ accounts, and did not publish copies on its own. For compromise, it was necessary to install one of the bait packages on Windows or in WSL.
By the time of publication, the discovered packages were removed from RubyGems and npm, and the GitHub account from which the bootloader was downloaded was not available. Computers where malicious dependence has managed to be installed, it is recommended to isolate, complete active browser and Telegram sessions and change passwords from another trusted device. When storing sid phrases on an infected computer, it is safer to consider the corresponding cryptocurrency wallets compromised and transfer funds to new addresses created in a clean environment.
