Fake Valkey repo with malware

[dbohdan]

I have found https://github.com/miketomphson/Valkey while browsing https://github.com/topics/valkey and https://github.com/topics/valkey-client. It's a repository that uses a background image that looks like corporate endorsement and has spammed topics. Its only contents is a readme linking to a release download that is a password-protected RAR file. VirusTotal reports malware if you repackage the contents of the RAR file without the password. I have reported the repository to GitHub but thought I'd also let you know.

P.S.: Valkey should use those topics to be the top repository for them.

[joshterrill]

Do you have a copy of this rar? It looks like they may have updated the software release to not include a password protected rar. Uploading what's there now doesn't seem to trigger any virus total scans, but the hash of the file that's there now doesn't match the file that you have, and I can extract the rar contents without using a password. There are still some strange things, though, like an mp4 file that isn't an mp4, a png that isn't a png, etc. I'm just wondering if whoever controls this repo deleted the release you saw, got smarter, and packaged it differently to evade AV/VT. If you can link to the rar that was there before, I'd love to take a look and see what I can find.

Edit: Just confirmed it by looking at the commits. They've removed the previous versions that had the password protection on it and uploaded a new one. If you still have a copy, I'd still like to look at it.

Edit2: I think I found where they are hiding all of the nasty stuff in the new build. Once you extract the top level electron package, you'll see there's a resource called elevate.exe and an app.asar, the asar being a common way to package electron files. You can use the @electron/asar package to unpack it, which reveals some more second stage downloader stuff, being executed under elevate.exe, which is supposed to allow elevated permissions on vista. (seems a bit out of date?) Going to look into this more, later.

Edit3: Found the shellcode that they download and execute... they didn't make it hard to find, did they?

Edit4: I've translated all of the C2 communication, which are all in Russian. It's very simple, it loads up electron, downloads shellcode, then executes it. Shocker, it's stealer malware:

https://www.virustotal.com/gui/file/0d19ca2b0f8bc8153ebfaf4db72bf93c84ec54158a6edecc99105015629b9f23?nocache=1

[dbohdan]

Sorry, I didn't keep the RAR. My VirusTotal upload would not match any of the original files because I extracted the RAR and repackaged the contents with 7-Zip. Good job looking into the current version! It was interesting. If GitHub support contacts me about the report, I'll send them a link to your comment.

[joshterrill]

I also reported it and sent some more details about how I got to the underlying stealer malware. So hopefully it'll get shut down soon. I also notified the valkey contributors on Twitter and email.

[madolson]

Thanks. I also already reported it this morning, we'll try to grab some more tags so it's clearer that we're the official repo.

[dbohdan]

GitHub support has messaged me saying they've taken action. The repository and the user account are gone.