AI Security Analysis: Eshelper

Analysis generated: 2025-12-11T21:02:44+13:00
Model: gemini-3-pro-preview

Quick Facts

AI Analysis

Based on the provided security scan data, here is the analysis for the "Eshelper" Firefox extension.

Executive Summary

The "Eshelper" extension represents a CRITICAL security threat and should be considered malicious. The analysis detected multiple high-severity indicators associated with malware behavior, including attempts to execute system commands, modify the Windows registry, and establish persistence on the host machine. With a risk score of 100/100, an unverified publisher, and a negligible user base, this extension poses an immediate risk of system compromise and data exfiltration. Do not install this extension.

Threat Assessment

The security posture of this extension is non-existent; it exhibits the characteristics of a Trojan or a supply-chain attack payload rather than a functional browser tool.

• System Integrity Compromise: The presence of postinstall_system_command and postinstall_registry_modification signatures suggests the extension contains code designed to break out of the standard browser sandbox. It attempts to interact directly with the underlying operating system, which is highly abnormal for a legitimate extension.
• Persistence and Evasion: Findings related to postinstall_persistence_mechanism and obfuscation indicate the code is designed to hide its logic from analysis and ensure it survives system reboots or browser restarts.
• Dropper Behavior: The postinstall_file_download and postinstall_file_manipulation signatures are characteristic of "droppers"—malware designed to download and install additional malicious payloads after the initial infection.
• Supply Chain Risk: The specific naming convention of the YARA matches (using the prefix postinstall_) strongly suggests the developer may have included compromised third-party libraries (likely NPM packages) containing malware, or the extension itself is a vehicle for a supply-chain attack.

Risk Justification

The 100.0/100 risk score is fully justified and accurate based on the following factors:

1. Malicious Capabilities: The code contains instructions for system-level manipulation (Registry, Shell Commands) which exceeds the scope of a browser extension.
2. Volume of Indicators: 4,613 findings is an exceptionally high number, suggesting the extension is packed with malicious libraries or Indicators of Compromise (IOCs).
3. Lack of Trust: The publisher "欧路软件" is unverified, and the user count (28) is extremely low, indicating no community vetting or reputation.
4. Obfuscation: The deliberate use of obfuscation prevents easy auditing of the code, a common tactic for malware authors.

Key Findings

• System Command Execution (High Severity): Multiple instances of postinstall_system_command indicate the extension attempts to run shell commands on the host OS.
• Registry Modification (High Severity): The postinstall_registry_modification finding suggests attempts to alter system configurations, likely to lower security settings or establish persistence.
• Persistence Mechanisms (High Severity): The code contains logic (postinstall_persistence_mechanism) designed to keep the malicious components active across restarts.
• Obfuscated Code (High Severity): Ten instances of obfuscation were detected, specifically flagged as postinstall_obfuscation, indicating an intent to hide malicious functionality.
• Unverified Origin (High Severity): The OriginsNotVerified tag confirms the code lacks proper signing or chain of trust verification.

Recommendations

1. Immediate Removal: If this extension is installed on any environment, uninstall it immediately.
2. Incident Response: Treat any machine that had this extension installed as compromised. Initiate a full endpoint scan for secondary payloads (malware dropped by the extension).
3. Blocklist: Add the UUID 2e5c5fc7-1179-5014-bcd0-c5d5b5424635 to the organization's browser policy blocklist to prevent installation.
4. Credential Rotation: Users who had this extension installed should rotate all passwords and session tokens, as postinstall_network_communication suggests data exfiltration capabilities.
5. Network Blocking: Investigate the 4,297 IOCs (likely domains/IPs) associated with this report and block them at the firewall/DNS level.

Mitigation Strategies

There are no safe mitigation strategies for using this extension.
Due to the presence of Remote Code Execution (RCE) signatures and persistence mechanisms, the risk cannot be mitigated while keeping the extension active. The only safe course of action is total removal.

Confidence Assessment

Confidence Level: 80% (High)
The analysis is based on static analysis YARA rules which are highly specific. While false positives are possible with generic signatures, the combination of Registry Modification, System Command, and Persistence signatures within a browser extension context is a definitive indicator of malicious intent. The "postinstall" nature of the tags suggests the malicious code might be embedded in a dependency, but the threat to the end-user remains the same.

Disclaimer

This analysis was generated by an AI model and should be reviewed by security professionals. The findings are based on automated security scanning and may include false positives. Always verify critical findings manually before taking action.