Hot Take Missed script malware by signature analysis

[Trident]

So I have two questions:
Did the exe in memory disabled MD before exectuion?
Could other AVs detect it in memory (fileless) while MD failed (although it can be detected if landing on drive according to your data)?

This attack will be blocked by everyone else detecting the executable, as the attacker will be unable to turn off the AV via PowerShell and is using file on disk (see post above).

Only Defender is “vulnerable” because it allows to be switched off with a single command, however, terminal needs to be executed with admin privileges.

 

[Parkinsond]

View attachment 292797

Amazing; the cmd file (not the exe file loaded in memory after execution of the cmd file) was not detected by any vendor.

 

[Trident]

Amazing; the cmd file (not the exe file loaded in memory after execution of the cmd file) was not detected by any vendor.

But in the real attack there is no file. The initial code that the user copies from goo.su or goose or whatever, firstly disables Defender and then fetches this script as a $variable.

 

[Parkinsond]

Defender is disabled prior to that

This explains why I failed to detect inspite of having signature to the downloaded exe according to VT.

 

[Parkinsond]

But in the real attack there is no file. The initial code that the user copies from goo.su or goose or whatever, firstly disables Defender and then fetches this script as a $variable.

Can the code disable other AVs as it did to MD?

 

[Parkinsond]

terminal needs to be executed with admin privileges

The blind spot exploited by several malware pieces.

 

[Trident]

Can the code disable other AVs as it did to MD?

No, because they do not have PowerShell management cmdlets. The best ways to disable these are:
-Gain kernel level privileges via abuse of driver
-log-in to the machine or management console and manually do it
- Use an exploit to impair them.

 

[Parkinsond]

No, because they do not have PowerShell management cmdlets. The best ways to disable these are:
-Gain kernel level privileges via abuse of driver
-log-in to the machine or management console and manually do it
- Use an exploit to impair them.

Take home message: If you like playing with suspicious scripts (must be be run as admin to work), MD is not enough.

 

[Trident]

Take home message: If you like playing with suspicious scripts (must be be run as admin to work), MD is not enough.

If you like copy-pasting them. Without copy-paste, the attacker must rely on other methods.

For example, malicious macro (works best). These can be prevented by ASR rules. Or, they can sneak in .net executable which can import powershell-this can be detected/prevented by many techniques. Or they can use a chain of fragmented scripts. The choices are endless but many of them can be blocked. The high fragmentation, specially coupled with lack of encoding is very difficult to detect. The rest isn’t.

 

[Parkinsond]

If you like copy-pasting them

I am not ignorant enough to do, but looks like several naive kids and teenagers fan of PC games can fall as victims for such a well-known trick.

 

[Parkinsond]

Didn't know that .su is still on the charts. Don't someone remove non-existant entities (soviet union) ? I should make a .su domain and translate my site into Russian and blame the US for all security woes just for fun. Putin would love the site.

redstar.com

 

[danb]

Some more info on the payload...

Sending request to SiriusLLM Model 0...

Model 0 confidence (85% Malicious) is below the 90% confidence threshold.
Sending request to Model 1...

Selected result: Malicious with 92% confidence from Model 1.

Total tokens: 3707 (3030 request / 677 response)

File path: C:\Users\User\Desktop\Instalihaly.exe
File hash: 19a331e787c3f5c3ba9c565f4e265a69f0804f92255abceccc670343e0ffdb2a
File size: 0.09 MB
File publisher: This file is a signable file type but has not been digitally signed.
WhitelistCloud verdict: Not Safe

Final Verdict: Not Safe with 92% confidence.

Analysis Summary
The file Instalihaly.exe (93 KB, 2025-11-07) is a 64-bit native console executable – not .NET – that imports only a handful of Win32 functions.
Despite the minimal import table, the presence of Internet-open/download primitives, resource-only code execution via VirtualProtect/ShellExecute, and multiple indicators (missing ASLR/DEP, no signature, resource-heavy, TLS table) point to a small packed or self-decrypting loader rather than a legitimate installer/helper.
Coupled with a high-confidence WhitelistCloud “Malicious” flag, we assess this artifact as malicious.

Detailed Analysis
• Import footprint: 12 functions, including InternetOpenA, ShellExecuteA, VirtualProtect, BitBlt, GdiplusStartup.
– InternetOpenA together with no documented updater/installer brand is a red flag for silent download-and-run behavior.
– VirtualProtect is commonly abused to make on-the-fly code sections writable/executable (typical for shell-code injection or run-time unpacking).
– GdiplusStartup/BitBlt suggest possible screenshot capability or simple steganography, not normally present in clean installers this small.

• Security mitigations disabled: ASLR = 0, DEP = 0, DllCharacteristics = 0x0.
Legitimate Windows software almost always opts-in to these protections; their deliberate absence is a classic malware evasion trick.

• Resources: ~67 KB (≈72 % of file) and a TLS callback table imply encrypted/packed payload stored in .rsrc and decrypted at thread-start.

• No digital signature; FileDescription et al. absent. WhitelistCloud marks it “Malicious”.

• Exports: none – acceptable for a dropper/loader whose only job is to deploy additional code.

Strings review (top meaningful)
/botY/sendMessageA37 – Telegram bot API fragment used for C2 or data exfil.
TelegramB – corroborates Telegram abuse for command & control.
USERNAME, COMPUTA: – likely part of victim-fingerprinting routine.
DOWNLOAD/oFILEDOWN – indicates download-to-execute logic.
SUCCESS – simple status keyword echoed back to C2.
Standard system DLL names already listed in imports; no embedded paths/URLs that would suggest a reputable publisher.

Likely purpose
A compact first-stage loader/downloader that beacons to a Telegram bot, downloads the next-stage payload, and executes it while taking a desktop snapshot for proof-of-infection. The executable masquerades as an “installer” (filename) but exhibits none of the metadata, signing, or protective features expected of legitimate setup programs.

Malware type: Downloader
Malware name: TgLoader.A

Final verdict: Malicious with 92% confidence.

 

[Parkinsond]

Xcitium just has joined the vendors detecting the malicious domain

 

[Trident]

A .net file (though this is clearly framework dependent) that pretends to be an installer can’t be 90 kb. The UI assets plus the install script, EULA and so on will be way larger. The typical online bootstrapper is usually a few megabytes.

At the same time it is not small enough to be simple “hello world app”. This size around 100kb is very common for stage1 .net framework-dependant console apps, when packing is applied.

The real ransomware is likely fetched from Telegram.

 

[Shadowra]

DeepInstinct test

PowerShell

Exe

 

[nickstar1]

Browser guard blocks the domain very powerful and doesn't get the credit it deserves.


t \

 

[Parkinsond]

Another sample; B blocked connection of mshta.exe to a url; typed such url in address field and enter: downloaded an hta file (initially was blocked by SS, and after download MD asked to upload for analysis); however, scan by MD is negative.



Uploaded to VT (detected by K and Avast).

VirusTotal

VirusTotal

www.virustotal.com

 

[Shadowra]

Avast too; it is missing in the list of Trident.

Avast

 

[Trident]

DeepInstinct test

PowerShell
View attachment 292799

Exe

View attachment 292800

DeepInstinct very aggressively targets the invoke PowerShell class. Invoke-RestApi and so on don’t go well with DI. They are used in this script.

I found another project from the same author that appears to be Android games resource mosifier/crack/cheat. It targets a game called Township.

The strings are mainly in Portuguese/Spanish/Brazilian just like some malware function names (computa which seems to add some mockery as well).

GitHub - Freeeloy/TWSCR

Contribute to Freeeloy/TWSCR development by creating an account on GitHub.

github.com

 

[Trident]

Another sample; B blocked connection of mshta.exe to a url; typed such url in address field and enter: downloaded an hta file (initially was blocked by SS, and after download MD asked to upload for analysis); however, scan by MD is negative.



Uploaded to VT (detected by K and Avast).

VirusTotal

VirusTotal

www.virustotal.com

View attachment 292802

What’s executing this command on such a regular interval (30 min sharp) is a scheduled task. The user should examine scheduled tasks and remove any that point to mshta or they can use HEAT, which will do it for them.
Anyway, it will soon be an executable.

Bitdefender paid has command line scanner. So this is the command line of mshta. It includes the malicious URL as well. The free edition won’t detect that.
HEAT will.