Loading malware…
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack campaign begins with a phishing email containing an TXZ archive (an XZ-compressed TAR file) as an attachment... It uses an invoice-themed lure and a sense of urgency to prompt the recipient to open the attachment without delay.
The attack campaign begins with a phishing email containing an TXZ archive (an XZ-compressed TAR file) as an attachment...
The JavaScript file extracted from the archive... The invoked PowerShell also uses the -w hidden flag...
It then launches conhost.exe in headless mode to hide malicious activity. The invoked PowerShell also uses the -w hidden flag to hide the PowerShell window.
The JavaScript file extracted from the archive contains several functions... The functions declare a large number of Process environment variables containing garbled text.
The extracted JavaScript stores malicious commands in process environment variables
The extracted JavaScript stores malicious commands in process environment variables (which are also filled with garbled text and multilingual comments as obfuscation)
the image file uses steganography to conceal data within the picture and uses “iTXt” and “IEND” chunks as markers to locate the encrypted data.
A recent example uncovered by Labs involves a phishing campaign that uses environment variables to conceal malicious commands, employing PawsRunner as a steganography loader to deliver the PureLogs .NET infostealer.
The PowerShell script first retrieves data from Process environment variables, then decodes and decrypts its payload using the AES algorithm, and finally decompresses it using the Gzip method.
The functions declare a large number of Process environment variables containing garbled text... The command executed is specified by one of these variables.
It then launches conhost.exe in headless mode to hide malicious activity. The invoked PowerShell also uses the -w hidden flag to hide the PowerShell window.
The extracted JavaScript stores malicious commands in process environment variables
The resulting .NET assembly—the executable payload—is then loaded and executed dynamically via reflection in a fileless manner.
After bypassing ETW and Windows 11 (24H2) security features, the next-stage payload is executed.
After that, the download module cycles through three hard-coded pairs of user-agents and three network APIs... to download data... After decoding the PNG file, we obtained another .NET execution file.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.