Source

• Malware Bazaar: https://bazaar.abuse.ch/sample/1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649/
• File type: Powershell
• Size: ~3 MB

Analysis

Obfuscation

There were various forms of obfuscation used in the Powershell script.

• Dead/junk code continues to be the most popular form of obfuscation:

function WmDF() {
    $tempVar = "Qhnkj"
    return $tempVar
}
...
[void]([System.Text.Encoding]::UTF8.GetBytes("mtQeEgWVAcyD"))
...
try { $nJGanBABhwWhziS = "KfGojzqE" } catch { }
...
$lKwAPLthZApKIqJ = [DateTime]::Now.AddMilliseconds(552)
...
$HyMZhnvHOPbNvcC = (565 * 1)
...

• Opaque predicates that always evaluates to True:

if (690 -eq 690) { $tPZDPlSebAGNJyC = "LxnqoHSUv" }
if (571 -eq 571) { $yNksXEqfsrlZQre = "JtcSCBVgD" }

• Unhelpful comments further bloating file size:

# xHwv
# wIzR

Deobfuscation

Utilities: https://github.com/nikhilh-20/re_tools/tree/main/powershell

> .\PsUnwrap-TrueIf.ps1 -InputFile C:\Users\Ashura\Desktop\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649.ps1 -OutputFile C:\Users\Ashura\Desktop\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass1.ps1
{"changed":380,"output_path":"C:\\Users\\Ashura\\Desktop\\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass1.ps1","output_bytes":3131205,"input_bytes":3139185}

> .\PsRemove-DeadCode.ps1 -InputFile C:\Users\Ashura\Desktop\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass1.ps1 -OutputFile C:\Users\Ashura\Desktop\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass2.ps1 -Aggressive
{"input_bytes":3131205,"output_path":"C:\\Users\\Ashura\\Desktop\\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass2.ps1","by_reason":"330x dead if (unreachable/empty), 350x dead function, 1640x no-op function, 1260x pure statement, 8130x dead variable cluster, 1600x dead store","changed":13310,"output_bytes":2634625,"aggressive":true}

> .\PsStrip-Comments.ps1 -InputFile C:\Users\Ashura\Desktop\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass2.ps1 -OutputFile C:\Users\Ashura\Desktop\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass3.ps1
{"input_bytes":2634625,"comment_lines_removed":700,"output_path":"C:\\Users\\Ashura\\Desktop\\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass3.ps1","output_bytes":2626225,"changed":700,"trailing_comments_removed":0,"comments_kept":0}

> .\PsCollapse-BlankLines.ps1 -InputFile C:\Users\Ashura\Desktop\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass3.ps1 -OutputFile C:\Users\Ashura\Desktop\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass4.ps1
{"changed":275,"output_path":"C:\\Users\\Ashura\\Desktop\\1c421d985a73a379bd2464b8d71c0a4db986135512facf204500e5dbe9e67649_pass4.ps1","output_bytes":2557961,"input_bytes":2626225}

Functionality

Once the script was deobfuscated, it was straightforward to see that it contained a base64 encoded + AES-192-CBC-encrypted payload which was loaded and executed via Reflection. This .NET payload is available on VT.