Quick Takeaways
- Attackers use multi-stage obfuscated JavaScript and PowerShell scripts to download and decode a malicious .NET payload, evading detection through environment-variable passing and file obfuscation.
- The final payload exfiltrates and executes from a steganographically hidden PNG file, manipulating image metadata to deliver encrypted malicious code.
- The campaign employs persistence techniques like scheduled tasks and stealthy AMSI bypasses, enabling sustained malware execution and evading endpoint defenses.
Threat, Techniques, and Targets
The analyzed malware sample is linked to LausivLoader, identified through JavaScript in a malicious email attachment. The email appeared to impersonate a legitimate company and requested a quote. It was blocked early due to suspicious content and failed email security checks. The malware used a multi-stage approach to infect systems.
Initially, malicious JavaScript was loaded into the %TEMP% folder. This script created a unique directory, stored encoded data in files named ‘a’ and ‘b’, and used environment variables to pass file paths to the next stage. The script registered a scheduled task called ‘MicrosoftEdgeUpdateTaskCore’ to maintain persistence. The JavaScript then launched a process to execute PowerShell with an encoded command.
The PowerShell stage retrieved file paths from environment variables, read the encoded payloads, and decoded them using AES-128-CBC, along with decompression. The payload was a .NET assembly loaded directly into memory, where it attempted to disable AMSI by patching specific functions. The assembly then fetched a second encrypted executable from a remote URL, which was disguised as a PNG image. This final payload, once decoded, could be either a native or a managed binary, depending on its type.
The malware targeted enterprise and individual systems vulnerable to spear-phishing. Its techniques included script obfuscation, environment-based data passing, process hollowing, and steganography, aiming to evade detection and maintain stealth.
Impact, Security Implications, and Remediation
This malware chain presents serious security risks. It can establish persistence, disable security features like AMSI, and download additional payloads. Its sophisticated obfuscation and multi-stage approach make detection difficult. The use of environment variables for data passing complicates static analysis, while steganography and code obfuscation hinder simple signature matching.
Organizations should review their email filtering rules and block similar phishing attempts. Monitoring for suspicious scheduled tasks, unauthorized scripting, and unusual network activity can help identify infections. Since the malware involves multi-stage decoding and evasion techniques, obtaining specific remediation guidance from the relevant security vendor or authority is recommended. Both detection and removal require detailed artifacts and tailored tools, so consult trusted cybersecurity sources or your security vendor for appropriate responses.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
