Obfuscated VBS and PNG Loaders Power New Open Directory Malware Campaign with RAT Payloads
LevelBlue has identified a sophisticated multi-stage malware delivery framework utilizing obfuscated Visual Basic Script (VBS) files, fileless PowerShell loaders, and payloads embedded within PNG images. This activity was detected by LevelBlue’s Managed…
LevelBlue has identified a sophisticated multi-stage malware delivery framework utilizing obfuscated Visual Basic Script (VBS) files, fileless PowerShell loaders, and payloads embedded within PNG images. This activity was detected by LevelBlue’s Managed Detection and Response (MDR) SOC via a SentinelOne alert concerning a suspicious VBS file.
The file, named Name_File.vbs, was located in a public downloads directory and was blocked prior to execution. Though containment was successful, further analysis revealed a complex operation involving modular loaders and reusable attacker infrastructure. During triage, no prior reputation for the file hash was found, indicating an isolated event. However, SentinelOne telemetry showed a Base64-encoded PowerShell command within the script, prompting additional investigation.
The decoded PowerShell script acted as a fileless loader, enforcing TLS 1.2 connections and using the Net webClient class to retrieve remote content. Instead of downloading a traditional executable, the script fetched a PNG image from a remote server. Inside this PNG file, researchers found embedded Base64-encoded data marked by custom “BaseStart” and “BaseEnd” tags. This data contained a .NET assembly that was decoded and executed in memory, a technique commonly associated with the PhantomVAI loader. This method helps the malware avoid detection by traditional security tools.
Further investigation uncovered an open-directory architecture on a domain hosting multiple accessible paths, such as /coupon/, /protector/, and /invoice/. These directories contained numerous obfuscated VBS files linked to various malware payloads, including XWorm and other RAT variants. This setup enables attackers to reuse the same loader framework while changing payloads as required. The /invoice/ directory revealed another infection vector involving a fake PDF file distributed as a ZIP archive.
This activity was detected by LevelBlue’s Managed Detection and Response (MDR) SOC via a SentinelOne alert concerning a suspicious VBS file.
The secondary chain included batch scripts encoded in UTF-16LE that executed in hidden mode and initiated outbound connections to retrieve more payloads. Analysis showed deployment of Python-based malware, including components linked to the Kramer family. These scripts performed memory injection, shellcode execution, and further payload staging.
Organizations are advised to restrict the execution of scripts like VBS and BAT files, especially from user-writable locations. Monitoring PowerShell activity and in-memory execution is critical, alongside blocking suspicious domains and limiting WebDAV traffic.
LevelBlue has implemented custom detections targeting similar VBS loaders, PNG-based payload staging, and related infrastructure to strengthen defenses against this evolving threat model.
Based on reporting by GBHackers.