Reverse Engineering a Phishing Chain | From BAT Script to Action1 Remote Access

The video demonstrates the reverse engineering of a phishing campaign that lures victims with a "view signed documents" theme, ultimately delivering a commercial remote access backdoor through multi-layered obfuscation 0:24-0:31.

Key Takeaways:
• The initial payload uses OS detection to redirect non-Windows users and tracks victims via Telegram 0:36-0:59
• Attackers leverage LOLBins (certutil) to decode base64 embedded within a fake certificate file, bypassing detection mechanisms 2:41-4:44
• The decoded VBScript gathers system information (computer name, username, drives) and uses hex XOR decoding (subtract 127) to decrypt the next stage 9:46-11:15
• Obfuscation is enhanced by using a unique decryption key for every string, requiring analysts to translate VBScript algorithms to Python for efficient decoding 20:51-21:24
• The final payload is a legitimately signed MSI from "Action 1 Corporation," a commercial remote access tool similar to Screen Connect, with an active C2 server identified 30:43-32:07
• The malware establishes persistence via the registry and disables Microsoft Defender's sample submission consent 14:47-14:59

The analysis highlights how threat actors abuse legitimate signed commercial software as backdoors while employing per-string key obfuscation to complicate reverse engineering efforts 34:01-34:38.

Sources:

• 0:24-0:31 Phishing trigger and "view signed documents" theme
• 2:41-4:44 LOLBins usage and fake cer