Reverse Engineering an SSA Phishing Attack | VBScript → PowerShell → Shellcode → XWorm

[BLUF]
This video details the analysis of a sophisticated social security-themed phishing campaign that deploys a multi-layered malware loader, ultimately delivering the XClient infostealer, rather than the typical ScreenConnect or OMI remote access tools 0:41.

Key Takeaways:
• The campaign utilizes a domain mimicking payday loans to target lawyers or the elderly, leveraging a Telegram token for victim data callback 1:12.
• Initial infection involves a small payload that drops an encrypted PowerShell script, which then downloads and executes a secondary stage in memory 3:38.
• The secondary stage employs shellcode injection into explorer.exe and establishes persistence via a scheduled task named "Windows Driver Helper" 6:01.
• Analysis reveals a complex decryption scheme using AES and GZip compression within a .NET assembly to hide the final payload 39:00.
• The final delivered payload is identified as XClient, an infostealer and clipboard hijacker, with configuration parameters including mutex names and C2 settings 45:51.

The analysis highlights a deviation from standard cybercriminal tactics, suggesting a more advanced or APT-like approach due to the heavy obfuscation and multi-stage deployment.

Sources:

• 0:41 Introduction to the non-typical social security phishing kit.
• 1:12 Analysis of the phishing domain and target audience.
• 3:38 Execution of the encrypted PowerShell payload.
• 6:01 Shellcode injection and persistence mechanisms.
• 39:00 Decryption logic using AES and GZip in the .NET stage.
• 45:51 Identification of the final XClient infostealer payload.