JSCeal is a cryptocurrency-focused stealer delivered as compiled V8 bytecode (JSC files) and executed by a bundled a script payload runtime, targeting cryptocurrency applications. The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers. The deobfuscation pipeline transforms View8 pseudocode into a form suitable for practical analysis by recovering enough structure and semantics to read the malware as code again: follow its logic, compare samples, locate capability branches, and validate behavior against concrete strings, APIs, paths, and data flow.
The complete toolkit is publicly available at jsc_deobfuscator. The pipeline includes multiple deobfuscation passes: propagating values, reconstructing strings, control-flow unflattening, resolving proxies and operations. Propagating values involves filling variables used in the code and performing simplifications to prepare for later stages. Reconstructing strings requires all arguments to be filled and works by retrieving the start function, parsing it, storing the list of string chunks, searching for string decoding functions, recovering parent index shifts, and calculating resulting index shifts.[/subscribe_to_unlock_form]
JSCeal is a cryptocurrency-focused stealer delivered as compiled V8 bytecode (JSC files) and executed by a bundled a script payload runtime, targeting cryptocurrency applications. The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers. The deobfuscation pipeline transforms View8 pseudocode into a form suitable for practical analysis by recovering enough structure and semantics to read the malware as code again: follow its logic, compare samples, locate capability branches, and validate behavior against concrete strings, APIs, paths, and data flow.
The complete toolkit is publicly available at jsc_deobfuscator. The pipeline includes multiple deobfuscation passes: propagating values, reconstructing strings, control-flow unflattening, resolving proxies and operations. Propagating values involves filling variables used in the code and performing simplifications to prepare for later stages. Reconstructing strings requires all arguments to be filled and works by retrieving the start function, parsing it, storing the list of string chunks, searching for string decoding functions, recovering parent index shifts, and calculating resulting index shifts.[emaillocker id="1283"]
The deobfuscated output enabled detailed analysis of JSCeal’s capabilities and their implementation, including keylogging, browser and credential theft, and HTTPS traffic interception through a local MITM proxy. The malware enumerates installed browsers, tries to query saved secrets, cookies, OAuth tokens, and other data.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Defence Evasion | T1027 | Obfuscated Files or Information | - |
| Defence Evasion | T1140 | Deobfuscate/Decode Files or Information | - |
| Credential access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Collection | T1005 | Data from Local System | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Defense Evasion | B0029 | Polymorphic Code |
| Anti-Static Analysis | B0032 | Executable Code Obfuscation |
| Discovery | E1083 | File and Directory Discovery |
| Anti-Behavioral Analysis | B0003 | Dynamic Analysis Evasion |
| Anti-Static Analysis | E1027 | Obfuscated Files or Information |
The following reports contain further technical details:
[/emaillocker]