Tag: Reverse Engineering

Investigating a Multi-Stage PowerShell Loader

Anurag Gawande1 Comment

Introduction

During recent threat hunting, I identified suspicious PowerShell content being served directly from an IP address and a domain:

hxxp://203[.]188[.]171[.]166/
hxxps://dorenzaa[.]com/

Both locations returned PowerShell rather than a conventional user-facing webpage.

The PowerShell was responsible for retrieving a ZIP archive from Vercel-hosted infrastructure, extracting it locally, and executing an executable from the extracted content.

Further investigation identified additional Vercel-hosted artifacts, including executable files, ZIP archives, and heavily obfuscated PowerShell loaders. Analysis of those loaders revealed hidden PowerShell execution, dynamically constructed IEX, Base64 and XOR-based obfuscation, additional payload retrieval, and a decoy “Verification complete!” message presented to the user.

The original infection vector has not been identified. Therefore, this analysis begins from the earliest stage currently visible in my investigation and does not attempt to attribute the activity to a specific threat actor or campaign.

Initial Discovery

The investigation started with:

203[.]188[.]171[.]166
dorenzaa[.]com

Both locations were observed serving PowerShell code directly.

At the time of this analysis, VirusTotal showed no security-vendor detections for either the IP address or the domain.

However, direct inspection of the content being served from these locations revealed PowerShell responsible for retrieving and executing an additional payload.

VirusTotal detection status reflects the results available at the time of analysis and may change as vendors update their detections.

VirusTotal results for 203[.]188[.]171[.]166

VirusTotal results for dorenzaa[.]com

The lack of security vendor detections did not mean that the content being served was benign.

Direct inspection showed PowerShell code at both locations.

PowerShell served from 203[.]188[.]171[.]166

PowerShell served from dorenzaa[.]com

PowerShell Retrieves Grape2.zip

Analysis of the PowerShell showed that it creates a working directory under the victim’s local application data directory:

%LOCALAPPDATA%\jsDownload

It then retrieves:

hxxps://file-host-alpha[.]vercel[.]app/Grape2.zip

The archive is stored under the newly created directory and subsequently extracted.

The script then executes:

%LOCALAPPDATA%\jsDownload\Grape.exe

The observed SHA-256 for Grape2.zip was:

3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61

This established the first Vercel-hosted location identified during the investigation:

file-host-alpha[.]vercel[.]app

Further analysis of the archive and Grape.exe would be required to determine its complete functionality.

Possible Second-Stage Delivery Point

An important unanswered question is how a victim reaches 203[.]188[.]171[.]166 or dorenzaa[.]com in the first place.

These locations directly return executable PowerShell rather than presenting a typical user-facing lure.

Based on this behavior, the PowerShell-hosting URLs appear to represent second-stage delivery points.

An earlier, currently unidentified initial payload or script may be responsible for reaching these locations and executing the returned PowerShell on the victim’s machine.

The initial infection vector or first-stage payload has not been identified, so this remains an assessment rather than a confirmed complete execution chain.

Discovery of Additional Vercel-Hosted Infrastructure

During further investigation of the associated Vercel-hosted files, I identified another host:

file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app

Multiple files were observed hosted on this Vercel instance:

  • UltraToolliteSetup.exe
  • mat.zip
  • draw.zip
  • loader1.txt
  • loader2.txt
  • loader22.txt
  • 1.txt
  • 4_27_1.txt

This was particularly interesting because several of the .txt files contained PowerShell loaders or heavily obfuscated PowerShell stages.

Files hosted on the Vercel instance

The presence of these files on the same Vercel instance establishes an infrastructure relationship between the observed artifacts. It does not, by itself, establish that every file performs the same function or belongs to a single malware campaign.

loader2.txt and loader22.txt

Analysis of loader2.txt and loader22.txt showed that both files contain the same PowerShell stager. The script launches PowerShell in a hidden window, downloads loader1.txt from the Vercel-hosted location, constructs IEX (Invoke-Expression), and executes the retrieved PowerShell content.

The loader also displays a “Verification complete!” message with the title “Google.com”. This appears to act as a decoy while the PowerShell activity takes place in the background.

loader2.txt and loader22.txt have the same SHA-256, confirming that the observed files contain identical content:

f139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530

loader2.txt / loader22.txt

PowerShell stager observed in loader2.txt and loader22.txt.

Google Verification Prompt

Verification complete!” prompt displayed by the PowerShell stager with “Google.com” as the window title.

loader1.txt: Heavy PowerShell Obfuscation

The next-stage loader1.txt file is considerably more difficult to inspect.

Rather than containing a small, immediately readable downloader, the file is heavily padded with junk code and irrelevant expressions.

The script contains large quantities of randomly named variables, unnecessary mathematical operations, fake conditions, irrelevant .NET references and other content designed to make the meaningful logic difficult to locate during manual inspection.

Obfuscated loader1.txt

Heavily padded and obfuscated PowerShell contained in loader1.txt

Despite the large amount of junk content, the meaningful decoding routine could be isolated.

The script contains embedded Base64 data, converts the data into a byte array, and applies a repeating XOR operation.

The repeating XOR key identified during analysis was: Write

Conceptually, the meaningful operation consists of:

Embedded Base64 data

  • Base64 decoding
  • Byte array
  • Repeating-key XOR (“write”)
  • Decoded PowerShell

The enormous size of the original loader is therefore misleading, the actual PowerShell recovered after deobfuscation is comparatively small.

Analysis of the heavily obfuscated loader1.txt revealed an embedded Base64-encoded payload that is decoded and processed using a repeating key XOR operation with the key write.

After removing the junk code and decoding the embedded data, the resulting PowerShell was much smaller and straightforward.

It downloads UltraToolliteSetup.exe from file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app, saves the executable as %APPDATA%\UltraToolliteSetup.exe, and executes it.

The observed SHA-256 for UltraToolliteSetup.exe is

d8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64

Further analysis of the executable would be required to determine its final functionality.

Obfuscated and Deobfuscated loader1.txt

Deobfuscating 4_27_1.txt

Another heavily obfuscated PowerShell file observed on the same Vercel instance was 4_27_1.txt.

Like loader1.txt, the file contains substantial amounts of junk code and irrelevant expressions intended to make manual inspection more difficult. The sample contains repeated fake operations, random variable names and long encoded data embedded among the junk content.

Deobfuscating 4_27_1.txt revealed PowerShell responsible for retrieving draw.zip from the same Vercel-hosted infrastructure. The decoded script saves the archive as %APPDATA%\draw.zip, extracts its contents into %APPDATA%\Default, and then executes %APPDATA%\Default\draw.io.exe.

The observed payload URL was:

hxxps://file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app/draw.zip

The SHA-256 of the observed draw.zip archive was:

a25bbc466416f65726c5e3f587f69515dd003f114c1eab29fdfca7b52fbd74b1

Further analysis of draw.exe would be required to determine its final functionality.

Other Hosted Artifacts

Additional artifacts observed on the second Vercel instance included:

  • mat.zip
  • 1.txt

These files were collected during the investigation and their SHA-256 hashes are included in the IOC section below.

The presence of multiple loaders, archives and executables on the same hosting location is noteworthy, but infrastructure co-location alone is not sufficient to conclude that all of the artifacts perform the same function or represent a single campaign.

No threat actor attribution is being made based on the currently available evidence.

Observed Techniques

Across the PowerShell files analyzed so far, I observed:

  • PowerShell-based payload retrieval and execution
  • Hidden PowerShell process execution
  • Invoke-WebRequest and Copy-Item for remote content retrieval
  • Dynamically constructed IEX
  • Execution of remotely retrieved PowerShell
  • Base64-encoded data
  • Repeating-key XOR obfuscation
  • Extensive junk-code padding
  • ZIP-based payload delivery
  • Archive extraction using PowerShell
  • Execution from %APPDATA% and %LOCALAPPDATA%
  • Windows Forms-based decoy verification prompt
  • Vercel-hosted loaders and payloads

What Remains Unknown

Several important parts of the activity remain unresolved.

Most importantly, the initial infection vector has not been identified. The earliest infrastructure currently visible in this investigation, 203[.]188[.]171[.]166 and dorenzaa[.]com, directly returns PowerShell code.

This suggests that an earlier payload, command, script or other execution mechanism may be responsible for reaching these locations on the victim system. However, that preceding stage has not been observed.

The final functionality of several downloaded artifacts also requires further investigation, particularly:

Grape2.zip / Grape.exe
UltraToolliteSetup.exe
draw.zip / draw.io.exe
mat.zip

Further static and controlled dynamic analysis would be necessary to determine their final behavior and whether the individual delivery paths ultimately converge.

Indicators of Compromise

Infrastructure

  • 203[.]188[.]171[.]166
  • dorenzaa[.]com
  • file-host-alpha[.]vercel[.]app
  • file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app

Files and SHA-256

Filename: UltraToolliteSetup.exe
d8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64

Filename: mat.zip
dbaf04df50088031ea64a9879c1adeee8b7e551c79dc247fa1bb4de5b263f7b4

Filename: draw.zip
a25bbc466416f65726c5e3f587f69515dd003f114c1eab29fdfca7b52fbd74b1

Filename: Grape2.zip
3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61

Filename: loader1.txt
fe693cc07c5d8a4d479e987e64ffb7473bd79066f3505e7f2c8f0b86815d0f08

Filename: loader2.txt
f139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530

Filename: loader22.txt
f139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530

Filename: 1.txt
e04487377e4f976ac18e7c1c5b22bc85e03b4423e73fd490e9d1641758faac81

Filename: 4_27_1.txt
4366679a4fea2c1bf7e29290f8e162e0db9d0707030b5b99ce870195afeb3782

loader2.txt and loader22.txt share the same SHA-256, indicating identical content under two filenames.

Observed File-System Paths

%LOCALAPPDATA%\jsDownload
%LOCALAPPDATA%\jsDownload\Grape2.zip
%LOCALAPPDATA%\jsDownload\Grape.exe

%APPDATA%\UltraToolliteSetup.exe

%APPDATA%\draw.zip
%APPDATA%\Default
%APPDATA%\Default\draw.io.exe

At the time of this analysis, several of the observed indicators and files had limited or no detection coverage on VirusTotal. These screenshots are included to document the detection state at the time of research. VirusTotal results can change over time as vendors update detections, so the screenshots should be treated as a point-in-time reference rather than a permanent verdict.

Conclusion

This investigation uncovered PowerShell-based payload delivery using Vercel-hosted infrastructure, including Grape2.zip, UltraToolliteSetup.exe, and draw.zip. Analysis of the hosted scripts revealed hidden PowerShell execution, obfuscation, dynamically constructed IEX, and a decoy “Google.com, Verification complete!” prompt. While the initial infection vector and final functionality of the downloaded executables remain unknown, the findings document multiple suspicious delivery stages and associated infrastructure that warrant further investigation.

Arechclient2 Malware Analysis (sectopRAT)

Anurag Gawande8 Comments

Overview

Arechclient2, also known as sectopRAT, is a Remote Access Trojan (RAT) written in .NET. This malware is highly obfuscated using the calli obfuscator, making its analysis challenging. Despite attempting deobfuscation using calliFixer, the code remained obfuscated but was still somewhat readable using dnSpy.

The sample analyzed has the following characteristics:

File Hash: EED3542190002FFB5AE2764B3BA7393B
File Size: 768KB
Original File Name: Bluefin.exe
File Type: .Net
Obfuscation Technique: calli obfuscator
Mutex Name: 49c5e6d7577e447ba2f4d6747f56c473
VT Detection: 61/72
File Download: any.run

Static Analysis

Obfuscation Technique

The malware is obfuscated using the calli obfuscator, as identified using Detect It Easy (DIE).

Attempts to deobfuscate the code using CalliFixer were unsuccessful, as shown below:

Extracted Strings

Extracting strings from the executable revealed significant indicators of the malware’s capabilities. Some of the key strings found include:

  • Browser Data Extraction: URL, User, Password0, AccountT, BrowserExtension, AutofillT, Logins, Cookies7, os_crypt, LocalState, encrypted_key
  • System and Hardware Information: HardwareType, OSVersion, Machine, ReleaseID, Language, ScreenSize, TimeZone, IPv4, Monitor
  • Installed Software and Processes: AvailableLanguages, Softwares, Processes, SystemHardwares
  • Targeted Applications and Services: Nord, Open, Proton (VPNs), Steam, Discord, Telegram, FTP, ScanBrowsers, ScanFiles, ScanFTP, ScanWallets, ScanScreen
  • Data Exfiltration and Storage: FileLocation, SeenBefore3, FileScannerArgT, OfApplication, Directory, Pattern, Recoursive7

Observed Functionalities

Upon analyzing the decompiled code, several key functionalities were observed:

  • Scanning and gathering information about installed web browsers, including browser extensions and stored credentials.
  • Extracting cookies, usernames, passwords, and autofill data.
  • Scanning the system for installed VPN services such as NordVPN and ProtonVPN.
  • Collecting system information, including hardware details and OS specifications.
  • Looking for installed game launchers, Telegram, and Discord configurations.
  • Scanning for FTP connections and stored credentials.
  • Searching for wallet configurations, indicating potential interest in cryptocurrency theft.

Dynamic Analysis

Upon execution in a controlled environment, the malware exhibited network-based behaviors, connecting to a remote Command and Control (C2) server:

  • C2 Server IP: 91.202.233.18
  • Port: 9000
  • Port:15647

  • Downloaded Files:
    • manifest.json (Defines the extension’s name, permissions, and scripts)
    • content.js (Core malicious script for keylogging and data theft)
    • background.js (Bypasses security restrictions and transmits stolen data)

Malicious Chrome Extension Disguised as “Google Docs”

The downloaded files are part of a Google Chrome extension masquerading as “Google Docs.” This extension is a stealthy data-stealing tool designed to exfiltrate user input across all websites. The files were retrieved from the following URL:

  • Download URL: http://91.202.233[.]18:9000/wbinjget?q=9A7A4DFA51C1DFA51C1DFC689A43860F0BECA70

Its functionality is split across three key files:

  • manifest.json
    • Declares the extension’s name and description (misleading claim of Google Docs offline editing)
    • Grants broad permissions, including , allowing script injection across all web pages
  • content.js
    • Injects event listeners into every webpage
    • Monitors and captures all user input fields (textboxes, checkboxes, dropdowns, buttons, text areas)
    • Sends recorded data, including usernames, passwords, credit card details, and form data, along with the URL to the attacker’s server
  • background.js
    • Acts as a middleman to bypass browser security policies
    • Uses browser permissions to make unauthorized HTTP requests to an external attacker-controlled server
    • Relays stolen data from content.js to the remote server
Installed Google Chrome Extension
Dropped JavaScript code and Json file.

Additionally, during debugging, it was observed that the malware connects to an external URL:

  • URL: https://pastebin.com/raw/wikwTRQc
  • Sandbox Analysis: The webpage at this URL contains the same IP (91.202.233.18)

Further Payload Analysis

During analysis, no additional payloads were observed being dropped or executed. However, given the RAT’s capabilities and network behavior, it is possible that further payloads may be delivered dynamically by the C2 server depending on the victim’s environment.

Indicators of Compromise (IoCs)

File Hashes

  • EED3542190002FFB5AE2764B3BA7393B

C2 Servers

  • 91.202.233.18:9000
  • 91.202.233.18:15647

Malicious URLs

Mutex

  • 49c5e6d7577e447ba2f4d6747f56c473

Security Implications

This malicious extension operates as a coordinated data-harvesting tool, capturing nearly all user input and exfiltrating it to a remote C2 server. The misleading name, broad web access, and ability to evade browser security make it a severe threat.

Recommendations:

  • Block network traffic to 91.202.233.18:9000 and 91.202.233.18:15647.
  • Monitor %AppData%/Local/llg for suspicious file creations.
  • Remove any unknown Chrome extensions, particularly those masquerading as Google Docs.
  • Use behavioral-based threat detection to identify suspicious activities.
  • Restrict execution of untrusted .NET applications.

This analysis highlights the evolving threats posed by obfuscated RATs and malicious browser extensions, emphasizing the need for enhanced security monitoring and strict browser extension controls.

If you found this analysis helpful, consider following my blog for more in-depth malware research and cybersecurity insights!

NanoCore RAT Malware Analysis

Anurag Gawande1 Comment

NanoCore is a well-known Remote Access Trojan (RAT) used by threat actors for espionage, data theft, and system control. In this post, I will analyze a NanoCore RAT sample with the hash 18B476D37244CB0B435D7B06912E9193 and explore its behavior, obfuscation techniques, and deobfuscation process.

File Hash MD5: 18B476D37244CB0B435D7B06912E9193
Filename: Sigmanly_0bbff62a45fc9776575ed143af2d7db332e2781d7e3de56eb3ff48c25d0c7b46
File size: 203.00 KB
NanoCore Client Version: 1.2.2.0
VirusTotal Detection Score: 64/72
File download: any.run

Static Analysis

Initial Inspection

Using Detect It Easy (DIE), I identified that the sample is a .NET executable and employs Eazfuscator obfuscation to hinder analysis.

Deobfuscation

To analyze the code effectively, I used de4dot to deobfuscate the executable. de4dot successfully restored readable class and method names, making it easier to understand the malware’s logic.

Below is how the deobfuscated code appears now.

Strings Analysis

Using SysInternals Strings, I extracted various strings from the binary and found the following indicators:

  • “Connecting to {0}:{1}..”
  • “/create /f /tn “{0}” /xml “{1}””
  • “schtasks.exe”
  • “CreateScheduledTask”
  • “/run /tn “{0}””
  • “RunScheduledTask”
  • “Host: {0}”

These strings indicate that the malware uses Windows Task Scheduler for persistence and C2 communication.

Dynamic Analysis

To gain deeper insights, I used dnSpy to debug the code and analyze its behavior in a controlled environment.

Execution Flow Analysis

Startup Routine: NanoCore attempts to achieve persistence by copying itself to a hidden directory and creating a registry entry.

  • During dynamic analysis, I found that it adds saasmon.exe under the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key.
  • It also creates a folder at C:\Program Files (x86)\SAAS Monitor to store its components.
  • Another folder is created at C:\Users\User\AppData\Roaming\81E42A3A-6BA0-4784-B7EC-E653E9E1A8ED, where the SAAS Monitor folder is placed, and saasmon.exe is dropped.

C2 Communication: The RAT connects to a remote Command-and-Control (C2) server, enabling an attacker to issue commands.

  • Wireshark Analysis: The malware attempts to establish connections to:
    • simpletest.ddns.net (Potential C2 domain)
    • 8.8.8.8 (Google DNS, likely used for connectivity checks)
    • Uses port 9632 to communicate with the given IP.
  • Plugin System: NanoCore features a modular plugin system, allowing attackers to load additional capabilities dynamically.
  • Installed Plugins: During dynamic analysis, I found that NanoCore installed the SurveillanceEx plugin, which enhances its spying capabilities.

  • Data Exfiltration: Captures keystrokes, screenshots, and clipboard data, sending them to the attacker.
  • It stores keylogs and clipboard data in C:\Users\User\AppData\Roaming\81E42A3A-6BA0-4784-B7EC-E653E9E1A8ED\logs\users\kbxxxxx.dat.

In the image above, you can see that it is storing clipboard data along with the commands and text I was entering in applications.

Task Scheduler Analysis: The code contains functions to create a scheduled task using schtasks.exe, but during dynamic analysis, no scheduled task was actually created. Below is an image of the relevant code snippet that shows its intent to use Task Scheduler for persistence.

Indicators of Compromise (IOCs)

  • File Hash: 18B476D37244CB0B435D7B06912E9193
  • Network Indicators: (Extracted from dynamic analysis)
    • C2 Domain: simpletest.ddns.net
    • IP Contacted: 8.8.8.8 (Google DNS, may be used for connectivity checks)
    • Port: 9632
  • Registry Changes:
    • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\saasmon.exe
  • File System Changes:
    • C:\Program Files (x86)\SAAS Monitor\saasmon.exe
    • C:\Users\User\AppData\Roaming\81E42A3A-6BA0-4784-B7EC-E653E9E1A8ED\SAAS Monitor\saasmon.exe
    • C:\Users\User\AppData\Roaming\81E42A3A-6BA0-4784-B7EC-E653E9E1A8ED\logs\users\kbxxxxx.dat (Stores keylogs and clipboard data)

Conclusion

NanoCore RAT remains a persistent threat due to its modularity and extensive feature set. Through deobfuscation with de4dot and debugging with dnSpy, I was able to uncover its core functionalities. Defenders should stay vigilant by leveraging threat intelligence, monitoring network traffic, and applying proactive security controls.

If you found this analysis helpful, feel free to share and stay tuned for more in-depth malware research!