Source

• Malware Bazaar: https://bazaar.abuse.ch/sample/6f9655f7ee0708a3feb0d6fbb0a5f7938c7431dec1eb850f37aa554fc704c681/
• File type: Powershell
• Size: 10.76 MB

Analysis

Obfuscation

The entire script content is on a single line making it difficult to read.

Deobfuscation

> .\PsExpand-Semicolons.ps1 -InputFile C:\Users\Ashura\Desktop\6f9655f7ee0708a3feb0d6fbb0a5f7938c7431dec1eb850f37aa554fc704c681\6f9655f7ee0708a3feb0d6fbb0a5f7938c7431dec1eb850f37aa554fc704c681.ps1 -OutputFile C:\Users\Ashura\Desktop\6f9655f7ee0708a3feb0d6fbb0a5f7938c7431dec1eb850f37aa554fc704c681\6f9655f7ee0708a3feb0d6fbb0a5f7938c7431dec1eb850f37aa554fc704c681_pass1.ps1
{"output_path":"C:\\Users\\Ashura\\Desktop\\6f9655f7ee0708a3feb0d6fbb0a5f7938c7431dec1eb850f37aa554fc704c681\\6f9655f7ee0708a3feb0d6fbb0a5f7938c7431dec1eb850f37aa554fc704c681_pass1.ps1","output_bytes":10760186,"input_bytes":10760021}

Configuration

The script contains a single large base64-encoded string. It decodes to a configuration JSON that contains subsequent payloads in base64-encoded form.

{
    "QNtqPKM": [
    {
        "ytEYwfjQ": "client32.ini",
        "BwsLwY": "MHg3ZmIy..."
    },
    {
        "ytEYwfjQ": "client32u.ini",
        "BwsLwY": "MHhmN2I3MmQ..."
    },
    ...
    ]
}

The payload filenames are listed below. Claude confirmed that, except one, they are all NetSupport Manager-related.

Filename	Category	Role	Verdict
client32.ini	Configuration	Client config file (ANSI format, pre-v12.50); stores C2 gateway address, encryption key (GSK), ports	Legitimate NetSupport component
client32u.ini	Configuration	Client config file (UTF-8 format, v12.50+); Unicode replacement for client32.ini	Legitimate NetSupport component
haliy.exe	Executable	Not a standard NetSupport filename. The legitimate launcher is client32.exe. Arbitrary renaming of client32.exe is a known NetSupport RAT tactic to evade detection	Suspicious — likely renamed client32.exe
HTCTL32.DLL	Library	NetSupport HTTP Transport library; handles HTTP-based communication channel	Legitimate NetSupport component
msvcp140.dll	Runtime	Microsoft Visual C++ 2015–2019 Runtime (C++ standard library); generic dependency	Generic Microsoft runtime (not NetSupport-specific)
msvcr100.dll	Runtime	Microsoft Visual C++ 2010 Runtime; generic dependency	Generic Microsoft runtime (not NetSupport-specific)
nskbfltr.inf	Driver Setup	NetSupport keyboard filter driver setup/INF file (nsk = NetSupport Keyboard)	Legitimate NetSupport component
NSM.ini	Configuration	NetSupport Manager installer settings; controls which components are installed	Legitimate NetSupport component
NSM.LIC	License	NetSupport Manager license file	Legitimate NetSupport component
pcicapi.dll	Library	NetSupport client API library; exposes client-side API	Legitimate NetSupport component
PCICHEK.DLL	Library	NetSupport integrity/license check helper DLL	Legitimate NetSupport component
PCICL32.DLL	Library	NetSupport Client core DLL; primary agent component	Legitimate NetSupport component
remcmdstub.exe	Executable	NetSupport “Remote Command” stub; enables remote shell/command execution on the client	Legitimate NetSupport component
TCCTL32.DLL	Library	NetSupport transport/communications control library	Legitimate NetSupport component

Staging Directory

A hidden directory with a 8 character random alphanumeric name is created on the Desktop. All the above payloads’ contents are base64-decoded and written to this directory. In this variant, all the names in config.json were filenames. However, the code also supports filepaths, and creates subdirectories within the hidden staging directory and writes payloads to it.

Persistence and Execution

An internet shortcut file is created under "$env:ProgramData\zyd89s5PS2\ with the filename: <8char_random_alphanumeric_string>.url. Its contents are shown below:

[InternetShortcut]
URL=file:///<path_haliy.exe>
IconFile=<path_haliy.exe>
IconIndex=0

A LNK file is created under $env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\ with the filename: <8char_random_alphanumeric_string>.lnk which points to explorer.exe with the above internet shortcut file as command-line argument to it, i.e. Explorer opens the internet shortcut file. The current working directory is set to the hidden staging directory.

The LNK file is executed via Start-Process. This results in the execution of the main payload, haliy.exe. This is the NetSupport Manager RAT executable.

Evasion

• The threat actor chose to deliver NetSupport RAT by base64-encoding the main payload and all its dependencies in the Powershell script itself instead of retrieving them from the C2 at runtime. This could be because they wanted to protect their C2 / infrastructure from blocklists and detection.
• This chain of powershell.exe -> explorer.exe -> -> haliy.exe could have been for evasion. Instead of directly starting the payload executable from powershell.exe, it is launched through explorer.exe which looks relatively more normal. However, if this is the case, it is a very shallow measure.

Anti-Forensics Cleanup and Potential Delivery Vector

The registry key HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU is accessed and the actual most-recent command strings executed through Win+R dialog box are erased. However, this flow does not erase MRUList key value which is a string that indicates the execution order of commands pointed to by the letter entries. So, forensic examiners will immediately notice these orphaned keys and know that the RunMRU key has been tampered with.

This anti-forensics step indicates that the user was potentially social engineered to directly/indirectly run this Powershell script in the Win+R dialog box.

Readiness Check

After the payloads are written to the hidden staging directory, the LNK file is launched through Start-Process, and before the anti-forensics cleanup, there is a while loop that checks for a maximum of 3 seconds if all payloads files are greater than 0 in size. I am not sure why this check exists.