Hunting BlindEagle | From Malicious SVG to Obfuscated VBS Payload Part 1

BLUF: This video documents the reverse engineering of a sophisticated "Blind Eagle" malware campaign targeting Spanish-speaking users, showcasing a multi-layered obfuscation technique involving base64 decoding, array reordering, and XOR encryption to deliver a click-fix payload. 2:03

Key Takeaways:
• The attack begins with an EML file containing an HTML attachment that triggers a zip download, serving as the initial delivery mechanism for the malware 3:02.
• The first layer of obfuscation involves embedding a large encoded string within the HTML, which the analyst decodes from base64 to reveal the next stage of the payload 3:58.
• A critical anti-analysis technique identified is the randomization of data buffers into arrays with specific index mappings, requiring the analyst to reconstruct the original data order using a Python script 13:05.
• The decryption process utilizes complex XOR logic with multiple keys derived from the reorganized data, highlighting the sophistication of the "Blind Eagle" group's infrastructure 17:30.
• After several layers of JavaScript decryption, the final payload is revealed to be a VBScript designed to collect username, password, and configuration data from the victim 44:11.
• The video emphasizes the importance of static analysis and reverse engineering to understand the malware's true functionality, as running it would only show a benign interface 06:43.

Closing Statement:
The analysis reveals a highly structured and multi-stage attack chain designed to evade detection while harvesting sensitive user credentials. This case study underscores the necessity of deep code inspection when dealing with politically motivated threat actors like Blind Eagle.

Sources:

• 0:43 Introduction to the "Blind Eagle" malware family and its target demographic.
• 2:03 Examination of the initial EML file and its embedded HTML attachment.
• 3:58 Decoding the base64 string to reveal the underlying payload structure.
• 13:05 Explanation of the array reordering technique used to obscure the malicious code.
• 17:30 Breakdown of the XOR decryption keys and logic.
• 44:11 Identification of the final VBScript payload and its credential harvesting goals.