Manually unpacking DarkTequila, stumped. Can anyone help?

Question

The malware is packed w/ UPX - can see 0/1 in sections.

Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to keep practicing my skills and to get better.

Opening the .exe (MD5 for malware: 9fbdc5eca123e81571e8966b9b4e4a1e) with OllyDbg brings us right to the POPAD instruction and several usual follow-on calls on the stack that also let us know it's typical UPX stuff.

The problem is, when I step-over the PUSHAD and land on the MOV instruction, if I follow the ESP register through the dump, the first four hex dump bytes are zeroed out.

With this said, I still set the HWBP on access just to see what it would lead me to, and it brings me to this:

And this is where I get stumped. If I try and step through to the JUMP instruction, it will only go to the conditional jump (JNZ) before it falls back to the PUSH instruction. I can manually click my way to the JMP instruction and run the program again, which leads me to the CMP ESP, EAX. If I run the program one more time, it brings me to 0139BC0E which looks like this:

There's a few kernel32 function calls that you might see at the beginning of a program, but honestly I am not sure if I am where I need to be for this unpacking. I doubt it.

All in all, I could use some help.

Answer 1

This may either be packed multiple times or contain additional obfuscations or anti-analysis. Use the "PUSHAD, breakpoint on ESP, run" method to find the tail transition, as you have. Then set a breakpoint on the tail transition (in your case, JMP 0002A99E) and run to that. The single-step to take the jmp and you'll be at the OEP, or the next stage of packing.

One way to figure out if you have it unpacked is to dump at this point (using OllyDumpEx, for example) and load it in your typical tools (IDA, exeinfo, PEiD, etc) to see what it looks like.

When I do this with your binary, I'm seeing what looks like some typical setup code, but then after the call to initterm, at 0040A7F2 there is a call using a memory address that contains zeros (hover over the dword_xxxx value to see). If you look back just a little bit, you'll see a call to a sub_xxxx that takes as an argument that dword_xxxx address. Diving into that function and the functions it calls, it looks like there is some parsing of the PE header (see cmp's with immediate values 5A4Dh and 4550h). In malware, this is typically done to find where kernel32 or other modules are in memory.

In addition to that, look at the Imports and you can see that there are references to LoadLibrary and GetProcAddress. If you look for those cross-references (aka xrefs), then you'll find functions that look like they have encoded values (a bunch of xor instructions in a row with immediates), so possibly dynamically rebuilding the IAT.

That's more info than you need to get past the UPX unpacking stage, but this malware has more anti-analysis techniques than just UPX packing, so you might have additional questions. The Practical Malware Analysis book has a good description of what you'll want to do next, and is generally a good reference, but feel free to start more questions on stackexchange if you want more help!

Answer 2

So to your first problem, the last two elements of the stack are 0 because PUSHAD pushes the registers in the following order on the stack. EAX, ECX, EDX, EBX, EBP, ESP, EBP, ESI, EDI

Since ESI and EDI are both 0 in your case, the two values on top of the stack are also 0.

In general, UPX is one of the easier ones to unpack, because it was not designed for security but compression.

So the way to go here, is to find the tail jump. This one can be recognized by the following zeroes and the jump to a far address.

I don't get your problem exactly, because you found the tail jump already. See at address 001026B1 the jump to 0002A99E. Consequently, your program starts at 0002A99E and this is your OEP. You can then remove the hardware breakpoint, set a breakpoint at the jump, continue running until it stops at the JMP and then step with F7, to debug the unpacked program.