I spent quite a bit of time investigating and reversing a malware sample I found in the wild. The initial malware sample, which I’ll explain in depth below, caught my attention because of the usage of a Lua obfuscator that I could not find a publicly available deobfuscator for. I am relatively new to malware reverse engineering and, with full disclosure, a lot of the work done here was with the assistance of AI. Late into the investigation I discovered a post from Netskope Threat Labs “OpenClaw Trap: AI-Assisted Lure Factory Targets Developers & Gamers” that corroborated a lot of what I found and gave me some leads on deeper investigation paths. I don’t know if any other intel services are tracking this malware family as I couldn’t find any other similar articles, but as I show a bit later on with some of my virustotal and github hunting, this is a fairly widespread campaign.
The full report/scripts/deobfuscated content/IOCs/etc are in the GitHub repo here:
Actions
Review the repo’s IoC Appendix for indicators present in your environment.
As this campaign involves Polygon blockchain RPC calls, IFIN again recommends blocking those endpoints in your environment.
Notes
LLM assistance was used in the creation of the report and deobfuscation, but the findings are valid.
A Sigma Rule is under review to be added to the ruleset. Consider importing this rule for detection once approved.
