Hunting BlindEagle | Deobfuscating VBS & Recovering the Shellcode Part 2

This video walks through reverse engineering a multi-layered malware dropper targeting organizations in Colombia, showing how the analyst deobfuscates VBS and PowerShell scripts to reveal AES-encrypted payloads. 0:30

Key Takeaways:
• The VBScript dropper uses string obfuscation and junk conditional logic to build a decryption routine, so analysts must understand code structure rather than rely on specific tools. 1:15
• Strings are split across multiple variables and executed via dynamically constructed PowerShell, complicating static analysis. 5:20
• The analyst identifies AES in ECB mode with PKCS7 padding, then locates the key and IV to decrypt each layer. 12:00
• A fake notification image targeting the Republic of Colombia distracts users while the malware runs in the background. 33:30
• Each layer decrypts the next via Base64 or custom encoding, ending in a final shellcode loader to be analyzed in a future video. 42:00

The analysis underscores the flexibility and patience needed as malware authors constantly evolve techniques to evade detection.

Sources:

• 0:30 Campaign overview targeting South America.
• 1:15 Initial VBScript dropper analysis.
• 12:00 AES encryption parameters identified.
• 33:30 Fake Colombian notification image.
• 42:00 Final loader decryption.