MerlinAgent

The .chm file executes cmd.exe along with the '/c start /min' commands to call the PowerShell process which executes inside a hidden window.

After examining the contents of page1.html, we found a huge JavaScript one liner embedded into the HTML within <script></script> tags. Its contents were heavily obfuscated, however we observed it executing another obfuscated PowerShell script.

The lure file presents itself as a Microsoft Help file, or .chm file... Code execution begins as soon as the user opens the document.

It also establishes persistence in the registry by creating a new key called 'ctlhost' located in 'HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run'

This will execute the binary file every time the user logs into the system.

This will execute the binary file every time the user logs into the system.

The PowerShell code is heavily obfuscated... Some obfuscation methods include Base64 encoding, GZIP compression, and char value substitutions.

Help files such as the lure document used in the STARK#VORTEX campaign, would be executed using the Windows binary hh.exe which is launched automatically when a user runs the .chm file.

It also establishes persistence in the registry by creating a new key called 'ctlhost' located in 'HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run'

the script downloads a payload from hxxps://files.catbox[.]moe/g1h7zr.bin decodes and decrypts it and saves it to the local Appdata folder

Once the payload establishes communication back to its C2 server, the attackers would have full control over the victim host.

Command and control from the MerlinAgent payload to the attacker’s C2 server used an encrypted channel over port 443.

While the attack chain is quite simple, the attackers leveraged some pretty complex TTPs and obfuscation methods in order to evade detection.