Defeating Node.js Malware through API Tracing
summary
A purpose-built Node.js Tracer instruments the runtime by hooking module APIs (installed via the preload require flag), spoofs API returns to defeat anti-analysis checks, logs filesystem and HTTPS activity, and extracts C2 domains and secret headers. The tool runs hundreds of samples in parallel and saved 300 next-stage payloads from a single campaign, then feeds concise trace logs to an LLM for automated IOC and behavior reports. Code and contributions live on GitHub.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:25Node.js malware threat
- 2:27What is tracing
- 3:52Tracing advantages
- 6:41Node.js for malware analysis
- 8:47Limitations of malware
- 10:51Node.js malware structure
- 13:20Case study: Gachi loader
- 14:47Node.js tracer tool
- 17:36Hook injection method
- 18:59Tracer features
- 19:21Live demo: Gachi loader
- 22:38Automating with LLMs
- 25:25Bulk malware analysis
- 26:50Key takeaways
- 28:15Q&A
related talks
47mNode.js Security: Breaking The Loop
31mWhat's Going on Inside the Node_Modules Folder
55mNode.js Security: Breaking The Loop
57mTroubleshooting Node.js Applications Under the Hood
47mBlack Clouds and Silver Linings in Node.js Security
31mIt's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder, Feross Aboukhadijeh
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
27mState of Node.js Security