Cloudflare-Malware Investigation Repository
February 6, 2025 ยท View on GitHub
Welcome to the Cloudflare-Malware Investigation Repository! This repository contains all the files and data related to a detailed investigation into a sophisticated malware campaign that abused legitimate cloud providers as well as AI-generated code to deliver a RAT Lumma Stealer. The goal of this repository is to provide a transparent and educational resource for cybersecurity enthusiasts, researchers, and professionals to analyze the malware, understand its behavior, and learn how to defend against similar threats.
Full Article
Repository Structure
Below is an overview of the files included in this repository and their purpose:
Key Files
| File Name | Description |
|---|---|
LICENSE | The license under which this repository is shared (MIT License). |
Logfile.PML | Process Monitor (ProcMon) log file capturing system activity during the malware execution. Useful for behavioral analysis. |
README.md | This file! Provides an overview of the repository and its contents. |
anyrun_report.pdf | A detailed report from the Any.Run sandbox analysis of the malware. |
assembly_dump.txt | Output of the strings command run on the decoded .NET assembly. Contains extracted strings and metadata. |
bytearray.json | A JSON file containing the byte array of the malicious PowerShell script. |
clipboard.js | The JavaScript file responsible for auto-copying the malicious command to the clipboard. |
decoded.ps1 | The deobfuscated PowerShell script used in the attack. |
malware.zip | A zipped archive containing the original malware samples for analysis. Handle with care! (Passowrd: Bitraven) |
network_traffic.pcap | A packet capture file (PCAP) of the network traffic generated during the malware's execution. Useful for analyzing C2 communication. |
provider.png | The malicious file disguised as an image. Contains obfuscated PowerShell code. |
stuff.md | A markdown file with additional notes, observations, and analysis from the investigation. |
How to Use This Repository
This repository is designed to encourage safe and responsible analysis of the malware. Below are some steps to get started:
1. Set Up a Safe Environment
Before analyzing any files, ensure you are working in a secure, isolated environment. Recommended tools and setups include:
- Virtual Machines (VMs): Use tools like VMware or VirtualBox to create an isolated environment.
- Sandboxes: Platforms like Any.Run, Hybrid Analysis, or Cuckoo Sandbox can safely execute and analyze malware.
- Network Isolation: Disconnect the analysis environment from the internet or use a controlled network to prevent accidental infections.
2. Analyze the Files
- Behavioral Analysis: Use tools like ProcMon (Process Monitor) and Wireshark to analyze the malware's behavior and network activity.
- Static Analysis: Examine the deobfuscated PowerShell script (
decoded.ps1) and the .NET assembly (assembly_dump.txt) to understand the malware's functionality. - Dynamic Analysis: Execute the malware in a sandbox environment and observe its interactions with the system and network.
3. Contribute and Share Findings
- If you discover new insights or techniques, feel free to open an issue or submit a pull request to share your findings with the community.
- Always document your analysis process and results to help others learn from your work.
Important Notes
- Safety First: The files in this repository contain live malware samples. Always analyze them in a secure, isolated environment to avoid accidental infections.
- Legal Compliance: Ensure that your analysis complies with local laws and regulations. Do not use this malware for malicious purposes.
- Attribution: If you use this repository in your research or work, please provide proper attribution by linking back to this repository.
Why This Repository?
This repository serves as a case study for understanding how modern malware campaigns operate, leveraging legitimate services and advanced techniques like AI-generated code. By analyzing these files, you can gain hands-on experience in malware analysis, improve your defensive skills, and contribute to the broader cybersecurity community.
Get Started
-
Clone this repository:
git clone https://github.com/BitravenS/Cloudflare-malware.git -
Have fun and stay safe!