Full Report
Research by: hasherezade Key Points Introduction JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). Its campaign activity dates back to March 2024 [1]; Check Point Research has been tracking the malware since early […] The post Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode appeared first on Check Point Research.
Analysis Summary
# Tool/Technique: JSCeal (aka WEEVILPROXY, MeadowLocust)
## Overview
JSCeal is a sophisticated infostealer and surveillance tool primarily targeting cryptocurrency users. It is unique in its delivery method, utilizing compiled V8 bytecode (`.jsc` files) executed by a bundled Node.js runtime. This approach bypasses traditional JavaScript analysis tools and conceals the malware's logic within version-specific binary artifacts.
## Technical Details
- **Type:** Malware Family (Stealer/Spyware)
- **Platform:** Windows, macOS (newer variants)
- **Capabilities:** Credential theft, cryptocurrency application targeting, keylogging, and HTTPS traffic interception.
- **First Seen:** March 2024 (Campaign activity); tracked by CPR since early 2025.
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1059.007 - Command and Scripting Interpreter: JavaScript]
- **[TA0005 - Defense Evasion]**
- [T1027.002 - Obfuscated Files or Information: Software Packing] (V8 Bytecode compilation)
- [T1406 - Obfuscated Files or Information] (javascript-obfuscator usage)
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Password Stores]
- **[TA0009 - Collection]**
- [T1056.001 - Input Capture: Keylogging]
- **[TA0011 - Command and Control]**
- [T1573 - Encrypted Channel]
- [T1185 - Browser Session Hijacking] (MITM Proxy)
## Functionality
### Core Capabilities
- **Information Stealing:** Targets browser data, stored credentials, and cryptocurrency wallets/applications.
- **Keylogging:** Captures user keystrokes to harvest sensitive information.
- **V8 Bytecode Execution:** Runs as compiled bytecode to evade static source code analysis.
- **Cross-Platform Support:** While initially Windows-focused, recent developments show targeting of macOS.
### Advanced Features
- **HTTPS Interception:** Implements a local Man-in-the-Middle (MITM) proxy to intercept and inspect encrypted network traffic.
- **Layered Obfuscation:** Uses `javascript-obfuscator` to implement RC4-protected strings, control-flow flattening, and proxy functions before the code is compiled to V8 bytecode.
- **Environment Bundling:** Ships with a specific Node.js runtime to ensure compatibility and execution of the `.jsc` payload.
## Indicators of Compromise
### File Hashes (Selected SHA256)
- `192342a5e4fcfc5e8ec430427e1dfa773fd324e3d7215047f36f1114ef930f4e`
- `0c72513efdae9785894b6e925590d0b59b652dda53b8cd882037a87e672a4a5a`
- `9f673e3b361f438e9986f2a7b2423d3d02dbecea0c220163566850ef6ab56626`
- `59c9038227c634f4e512afaa98f2ca998b0aaac83437c218686c51acbda7873e`
### File Names
- `.jsc` files (Compiled V8 Bytecode)
- Bundled Node.js executables (`node.exe`)
### Behavioral Indicators
- Execution of Node.js with non-standard `.jsc` or `.cache` files.
- Modification of local proxy settings or installation of root certificates for MITM purposes.
## Associated Threat Actors
- **MeadowLocust** (Also tracked as WEEVILPROXY)
## Detection Methods
- **Signature-based detection:** Scanning for specific V8 bytecode headers and bundled Node.js runtimes.
- **Behavioral detection:** Monitoring for unexpected local proxy creation or keylogging activity originating from Node.js processes.
- **YARA Rules:** Check Point Research has released tools and indicators for identifying JSCeal's specific obfuscation patterns (available in the `jsc_deobfuscator` repository).
## Mitigation Strategies
- **Endpoint Protection:** Use EDR solutions that monitor for suspicious child processes of Node.js.
- **Application Whitelisting:** Prevent the execution of unauthorized Node.js runtimes.
- **Certificate Monitoring:** Monitor for the unauthorized installation of root certificates in the system store.
## Related Tools/Techniques
- **View8:** The decompiler used as a foundation for JSCeal analysis.
- **javascript-obfuscator:** The public tool used by the actors to protect the source code before compilation.
- **V8 Bytecode Compilation:** A technique also seen in other high-end JavaScript-based malware to hinder reverse engineering.