Inside the Node js Payload | Extracting SEA & Reversing the Shellcode Loader Part 2

[BLUF] This analysis dissects a complex Node.js malware dropper, tracing a multi-stage attack chain from DLL side-loading and encrypted JavaScript payloads to shellcode injection for persistence on Windows systems 2:43.

Key Takeaways:
• The initial Node.js application is encoded in a container format; analysts identified a hidden 6MB Windows executable (third stage) by locating the 'MZ' header within the binary data 1:29.
• This JavaScript payload establishes persistence by creating desktop shortcuts, scheduling tasks named "Windows Defender Verify," and preparing for process injection 7:08.
• The malware utilizes XOR decryption with the key "red team VM" to decrypt embedded shellcode and other data structures within the script 16:40.
• The final stage involves extracting, decrypting, and injecting shellcode into a running process, representing a sophisticated attack transitioning from DLL side-loading to final execution 24:09.
• The complete attack chain requires detailed debugging to fully understand the final shellcode's behavior, highlighting the complexity of modern malware evasion techniques 29:00.

[Closing statement] This case study underscores the necessity of deep static and dynamic analysis to uncover hidden resources and decryption logic in multi-stage malware. Further investigation is needed to determine the specific actions of the final decrypted shellcode.

Sources:

• 2:43 Overview of the malware analysis
• 1:29 Extraction of the third-stage executable
• 7:08 Analysis