Source

• Malware Bazaar: https://bazaar.abuse.ch/sample/ee15d5c331416dc251b35cc7c738bb54de0608daeb4ccf31dee3694c2b6c58b7/
• File type: Powershell
• Size: ~16 MB

Analysis

Functionality and Obfuscation

The Powershell script embeds the main payload in base64 + AES-256 CBC encryption.

$HJZOImaYXmios5B1JKUf = [Convert]::FromBase64String("bQ4Gp9aw6aeLz8jQm8IWwpmVAvdQq0PVVwz7WvlvVmA=");
$Zf8bo8oyVc47 = [Convert]::FromBase64String("50h6YKpa+LV/bnyKJmFetA==")
$okb28IVi4DCB4urG = [Convert]::FromBase64String("vi3e3qB/AyNtBkAHCS8N...")

$oZ303sAtuL8xGXa = [Security.Cryptography.Aes]::Create();
$oZ303sAtuL8xGXa.Key = $HJZOImaYXmios5B1JKUf;
$oZ303sAtuL8xGXa.IV = $Zf8bo8oyVc47
$K4C1jUZr62as = $oZ303sAtuL8xGXa.CreateDecryptor().TransformFinalBlock($okb28IVi4DCB4urG, 0, $okb28IVi4DCB4urG.Length)

In addition, there’s also ~400 KB of dead/junk code:

$ErrorActionPreference = 'SilentlyContinue'
$q6BKwqFyQMsrJN6 = @('0b367d...59d2', '72eda...4506')
$pumiDP9ibU7wdM4 = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OGZmOTEw...Y0MQ=='))
$sJAbVe3UtVababV = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('MDU0YW...JjNA=='))
$u1Jyjom85CvQvXL = '5f17...'

Deobfuscation

Utilities: https://github.com/nikhilh-20/re_tools/tree/main/powershell

> .\PsRemove-DeadCode.ps1 -InputFile C:\Users\Ashura\Desktop\ee15d5c331416dc251b35cc7c738bb54de0608daeb4ccf31dee3694c2b6c58b7.ps1 -OutputFile C:\Users\Ashura\Desktop\ee15d5c331416dc251b35cc7c738bb54de0608daeb4ccf31dee3694c2b6c58b7_pass1.ps1
{"input_bytes":16248979,"output_path":"C:\\Users\\Ashura\\Desktop\\ee15d5c331416dc251b35cc7c738bb54de0608daeb4ccf31dee3694c2b6c58b7_pass1.ps1","by_reason":"436x dead store","changed":436,"output_bytes":15870871,"aggressive":false}

Main Payload Functionality

• On decoding and AES-256-decrypting the embedded payload, a ZIP file is produced. The script writes this into the current user’s temp directory AppData\Local\Temp under a random directory name (like inje00hq.rnz) with filename package.zip
• The Powershell script then unzips the archive’s contents into the current directory (AppData\Local\Temp\<same_rand_dir>).
• The archive contains a malware executable which is executed in a hidden window as a child process.