Static Deobfuscation Defeats JSCeal Cryptocurrency Malware Defenses
Compiled code no longer functions as an impenetrable shell protecting JSCeal. Check Point specialists recently developed a fully static deobfuscation method. This innovative technique effectively transforms the hidden malware into readable pseudocode. Crucially, it accomplishes this without requiring dynamic execution. The team rigorously tested this method against 23 distinct samples collected over several months. They successfully produced highly readable results in every single instance.
The Threat of JSCeal
JSCeal, frequently identified as WEEVILPROXY or MeadowLocust, aggressively targets cryptocurrency service users. This sophisticated malicious campaign has remained highly active since at least March 2024. The attackers primarily distributed counterfeit applications through deceptive advertising networks. They subsequently executed the final malicious payload utilizing an embedded Node.js environment. Check Point researchers have meticulously tracked this specific malware family since early 2025.
Overcoming Double Obfuscation
Conventional analysis tools struggled significantly when analyzing JSCeal. This difficulty stemmed directly from its robust double-masking techniques. The developers initially tangled the underlying JavaScript code. Later, they aggressively compiled it directly into internal V8 bytecode. The resulting compiled cache depended entirely upon the specific engine version utilized. Furthermore, it completely lacked numerous original source code elements. Standard deobfuscation tools inherently rely upon these missing elements to function correctly.
The New Deobfuscation Pipeline
The newly developed analysis chain operates systematically. First, it carefully unpacks the initial file, which the developers compressed utilizing the Brotli algorithm. Next, it seamlessly transfers the extracted cache directly to the compatible View8 disassembler and decompiler. Sequential processing modules then systematically restore hidden values and encrypted strings heavily protected by RC4. They also meticulously straighten the deliberately tangled execution order. Finally, they remove redundant intermediary functions. The researchers generously published this complete toolset directly on GitHub.
Unveiling Hidden Capabilities
The resulting sanitized pseudocode finally revealed JSCeal’s comprehensive capabilities. Many of these functions might never manifest during a single, isolated dynamic test execution. The malware aggressively intercepted keystrokes and captured detailed screenshots. It stealthily stole passwords, session cookies, browser data, and sensitive Telegram information. A localized proxy server intercepted and maliciously manipulated HTTPS traffic utilizing a controlled, fraudulent certificate. Additionally, specialized handlers systematically collected user balances across 25 distinct cryptocurrency platforms.
Evolving Malware Tactics
The developers behind JSCeal continually complicate subsequent analysis efforts. Recent variants introduced a completely different version of the underlying V8 engine. They also incorporated supplementary AES-256-CBC encryption. This encryption utilizes a specific key derived directly from the previous infection stage. Furthermore, the malware now actively supports macOS environments. The currently released analyzer version specifically targets the older V8 build. However, Check Point definitely plans to add support for the newer version later. Artificial intelligence can potentially assign comprehensible names to obscure functions. Nevertheless, such AI-generated suggestions still require meticulous manual verification against the core code and data flows.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
