unclassified-js-bitbucket-stego-dropper: 56ea37ef — JScript with fixed-delimiter concat obfuscation and image-steganography .NET loader

Executive Summary

A JScript dropper masquerading as a scanned document (Scan000342.js) hides a PowerShell payload inside a massive string-concatenation block using a fixed noise delimiter (bngbimfrhIbkmi). The decoded PowerShell retrieves a Base64-encoded .NET assembly from an attacker-controlled image file using image-steganography markers (<<START>>/<<END>>), then reflectively loads it via Assembly.Load. The final stage communicates with a C2 at lerdeen[.]life. The JavaScript launcher uses WMI to spawn the PowerShell in a hidden window. ^[file.txt]

What It Is

• SHA-256: 56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81
• Filename: Scan000342.js (social-engineering lure: scanned document)
• Size: 68,389 bytes
• Type: Plaintext JScript (Windows Script Host compatible)
• Obfuscation: Custom fixed-delimiter string concatenation with a 13-character noise token
• Packaging: None (no packer, no encryption — the obfuscation is the packaging)
• Signing: None ^[file.txt] ^[exiftool.json]

How It Works

1. JScript Launcher — Fixed-Delimiter Concatenation Obfuscation

The entire script consists of 1,532 lines of Fbpamhie += "..." concatenations. Each line interleaves payload characters with the noise token bngbimfrhIbkmi. At line 1,534, the noise is stripped via Fbpamhie.replace(/bngbimfrhIbkmi/g, ""). ^[strings.txt:1]

The cleaned string reveals a PowerShell command that:

• Defines a $ddsfdfdjhsdfgdgo variable containing a Base64 blob
• Replaces f# with r (a character-substitution anti-signature step)
• Decodes via UTF-16 LE and executes via iex ^[strings.txt:1534]

2. PowerShell Stage — Image-Steganography Loader

The decoded PowerShell (2,366 chars) performs the following:

• Sets TLS 1.2 ([Net.SecurityProtocolType]::Tls12) to ensure HTTPS fetch compatibility
• Defines DownloadDataFromLinks: shuffles an array of URLs, attempts each until one succeeds, then returns the raw byte array
• Two hardcoded payload URLs:
  • https://bitbucket.org/ghkjkghlkgl/ghf/downloads/2.jpg ^[decoded payload]
  • https://paste.sensio.no/BirdsKnocked ^[decoded payload]
• Searches the downloaded image/text for <<START>> and <<END>> markers, extracts the Base64 payload between them
• Decodes the payload to a byte array and loads it via [System.Reflection.Assembly]::Load($commandBytes) ^[decoded payload]
• Retrieves type myprogram.Homees and invokes method runss (built via string concatenation runs + s)
• Passes a reversed C2 URL: s://lerdeen.life/wp-content/ScoprpS.txt (reversal confirmed) ^[decoded payload]

3. WMI Hidden Process Spawn

The JScript launcher uses GetObject("winmgmts:root\\cimv2") to create a Win32_ProcessStartup instance with ShowWindow = 0 (hidden window), then spawns the PowerShell via Win32_Process.Create. ^[strings.txt:1536]

Decompiled Behavior

Not applicable — this sample is a plaintext script, not a compiled binary. No PE structure, no Ghidra/radare2 surface. The obfuscation layer is purely string-level.

C2 Infrastructure

• Stage 1 URLs (payload staging):
  • https://bitbucket[.]org/ghkjkghlkgl/ghf/downloads/2.jpg (image-steganography carrier) ^[decoded payload]
  • https://paste.sensio[.]no/BirdsKnocked (fallback text carrier) ^[decoded payload]
• Final C2 endpoint (passed to .NET assembly):
  • https://lerdeen[.]life/wp-content/ScoprpS.txt (reversal layer applied) ^[decoded payload]
• No mutex names, named pipes, or hardcoded registry keys recovered statically.

Interesting Tidbits

• The f#→r substitution inside the Base64 string is a low-cost anti-signature measure: it breaks naive base64 regex extraction and defeats copy-paste decoding without the replace step. ^[strings.txt:1534]
• The image-steganography markers (<<START>>/<<END>>) allow the attacker to hide the payload inside a seemingly legitimate JPG or text file on a free hosting service. ^[decoded payload]
• The phantomSgfdghift and quantumRipple functions are dead code — never called. They exist to pad the script and add noise to static analysis. ^[strings.txt:1535]
• The PowerShell uses Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 as a no-op delay/anti-emulation step before loading the assembly. ^[decoded payload]
• The runss method name is constructed at runtime via string concatenation (runs + s) to defeat static string matching. ^[decoded payload]
• The .NET type myprogram.Homees suggests a custom-built or lightly obfuscated .NET assembly rather than a commodity RAT framework. ^[decoded payload]

How To Mess With It (Homelab Replication)

Replicating the JScript obfuscation

1. Take your PowerShell payload and base64-encode it (UTF-16 LE).
2. Choose a fixed noise token (e.g., bngbimfrhIbkmi, length 13).
3. Interleave the noise token between every character of your payload string.
4. Emit lines: var Fbpamhie = "..."; followed by Fbpamhie += "..."; repeated until the full payload is reconstructed.
5. Append: Fbpamhie = Fbpamhie.replace(/bngbimfrhIbkmi/g, "");
6. Append WMI spawn code with ShowWindow = 0.
7. Save as Scan000<N>.js.

Replicating the image-steganography loader

1. Base64-encode your .NET assembly DLL.
2. Wrap with markers: <<START>>BASE64PAYLOAD<<END>>.
3. Embed inside a JPG or text file hosted on a free service.
4. In PowerShell: DownloadData, find markers, extract, [Convert]::FromBase64String, [Assembly]::Load.

Deployable Signatures

YARA Rule

rule unclassified_js_bitbucket_stego_dropper {
    meta:
        description = "JScript fixed-delimiter concat obfuscation with WMI hidden process spawn"
        author = "PacketPursuit"
        date = "2026-07-08"
        sha256 = "56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81"
    strings:
        $s1 = "Fbpamhie += \"" ascii wide
        $s2 = /bngbimfrhIbkmi/ ascii wide
        $s3 = "GetObject(\"winmgmt" ascii wide
        $s4 = "Win32_Process" ascii wide
        $s5 = "ShowWindow =" ascii wide
        $s6 = "<<START>>" ascii wide
        $s7 = "<<END>>" ascii wide
        $s8 = "bitbucket.org/ghkjkghlkgl/ghf/downloads/2.jpg" ascii wide
    condition:
        filesize < 200KB and
        3 of ($s*) and
        #s1 > 500
}

Behavioral Hunt Query (Sigma-like)

process_creation:
  CommandLine|contains:
    - 'winmgmts'
    - 'Win32_ProcessStartup'
    - 'ShowWindow = 0'
    - 'bitbucket.org/ghkjkghlkgl/ghf/downloads/2.jpg'
    - 'paste.sensio.no/BirdsKnocked'

IOC List

Detection Signatures

• MITRE ATT&CK T1059.005: Visual Basic (JScript variant) execution via Windows Script Host
• MITRE ATT&CK T1059.001: PowerShell execution via embedded Base64
• MITRE ATT&CK T1027.001: Obfuscated files or information — binary padding via dead-code functions
• MITRE ATT&CK T1564.003: Hide Artifacts — hidden window process spawn via WMI
• MITRE ATT&CK T1105: Ingress Tool Transfer — download from remote URLs
• MITRE ATT&CK T1071.001: Application Layer Protocol — HTTPS C2
• MITRE ATT&CK T1620: Reflective Code Loading — .NET assembly loaded in-memory

References

• Artifact ID: c02ea233-109a-4f56-8387-0c685bf78e37
• Source: MalwareBazaar (OpenCTI malware-bazaar connector)
• Filename: Scan000342.js
• Related wiki pages: unclassified-js-bitbucket-stego-dropper, js-fixed-delimiter-concat-obfuscation, wmi-hidden-process-powershell

Provenance

• file.txt — file utility output (ASCII text)
• strings.txt — raw strings extracted via strings -n 6
• exiftool.json — ExifTool metadata (TXT, 68KB, 1,578 lines)
• triage.json — triage pipeline classification (no family, tier=deep)
• Decoded payload — manual extraction via Python regex + base64 + UTF-16-LE decode
• dynamic-analysis.md — CAPE skipped (ASCII text, non-binary class)

^(/intel/analyses/56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81.html)