Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
Check Point's hasherezade details static deobfuscation of JSCeal, a V8-bytecode stealer targeting cryptocurrency applications since March 2024.
JSCeal is an infostealer distributed as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime, aimed at cryptocurrency applications. Other vendors track the same family under the names WEEVILPROXY or MeadowLocust. Check Point Research has tracked the campaign since early 2024, with activity dating back to March 2024. The write-up presents a static approach to unpacking the bytecode without executing it.
- JSCeal is delivered as compiled V8 bytecode (.jsc) run by a bundled Node.js runtime
- Stealer targets cryptocurrency applications and has been active since March 2024
- Check Point publishes a static deobfuscation technique for V8 bytecode
- Same family is also tracked as WEEVILPROXY and MeadowLocust
- Vendors
- Check Point Research
From the original article
Research by: hasherezade Key Points Introduction JSCeal is a stealer delivered as compiled V8 bytecode (. jsc) and executed by a bundled Node. js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust).
research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.