Folder structureįirstly, let’s take a look at the folder structure from which the malware operates. To illustrate the decryption process even further and to ease the work of other researchers, and others who are interested we added our IDAPython script that will decrypt all the strings to our Github page. The only exception is that the key string sequence is not modified before usage.Īt first, a Base64-encoded string is decoded and then it is passed on to the xor_decrypt function, along with a XOR key string. The same cipher is used for string encryption as was described in the subsections of the pe.bin decryption section in the previous part of the blog series. Nearly all the strings in the binary are encrypted. If the Meh process detects that it’s not actually running inside a legitimate process, it tries to fix this by creating a new injection subthread and injecting the payload into a legitimate process.

Thus, Meh always harms its victims via legitimate processes.

notepad.exe or regasm.exe, along with massive multithreading. This payload is a somewhat penultimate stage, because the malware actually uses a quite massive parallelization of its tasks via several injections to Windows processes, e.g. Map illustrating the countries Meh has targeted from June to November 2020 Analysis Meh password stealer – pe.binĪfter the MehCryptor is finished running its preparations, the Meh password stealer PE is loaded, an indirect jump is performed right into the decrypted Meh payload, written in Borland Delphi.

Tcpview steam trick