unclassified-js-bitbucket-stego-dropper

JScript dropper family using fixed-delimiter string-concatenation obfuscation, WMI hidden-process execution, and image-steganography payload delivery. Two confirmed siblings (56ea37ef, a09e7790) sharing an identical builder template with campaign-specific noise tokens, Bitbucket repositories, and C2 endpoints.

Overview

This family represents a Windows Script Host (JScript) dropper that conceals a PowerShell payload inside hundreds of += concatenation lines interleaved with a fixed noise token. The PowerShell stage downloads a .NET assembly hidden inside image or text files using steganography markers, then reflectively loads it in-memory.

Build Stack

• Language: JScript (Windows Script Host)
• Obfuscation: Custom fixed-delimiter string concatenation (no commercial packer)
• Launcher: WMI (Win32_Process.Create with ShowWindow = 0)
• Stage 2: PowerShell (TLS 1.2, image-steganography fetch, Base64 decode, [Assembly]::Load)
• Stage 3: Custom .NET assembly (myprogram.Homees)
• Signing: None

Deploy / TTPs

• T1059.005 — Visual Basic (JScript via WSH)
• T1059.001 — PowerShell
• T1027.001 — Obfuscated files or information (noise-token padding)
• T1564.003 — Hide Artifacts (hidden window via WMI)
• T1105 — Ingress Tool Transfer (HTTPS payload fetch)
• T1071.001 — Application Layer Protocol (HTTPS)
• T1620 — Reflective Code Loading (.NET assembly)

Variants / Aliases

• Scan000342.js — scanned-document lure (first observed sample, 56ea37ef)
• a09e7790... — numeric hash filename, no document lure; noise token rFcogaamkkmfcg, Bitbucket repo mywtestwusbect/hfghfgdfgdfg, GitHub Raw C2 (a09e7790)

Notable Analyses

• 56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81 — First observed sample; Bitbucket + paste.sensio.no image-steganography carriers, lerdeen.life C2. ^[/intel/analyses/56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81.html]
• a09e7790157785ac318b2895ef8bd370c4d1e4e40138435f12367259caf83a6c — Second confirmed sibling; same builder template, new noise token, new Bitbucket repo mywtestwusbect/hfghfgdfgdfg, GitHub Raw C2 (ultrarenewrecargado-alt/DATESIMPORT). OpenCTI family label namesake. ^[/intel/analyses/a09e7790157785ac318b2895ef8bd370c4d1e4e40138435f12367259caf83a6c.html]

Related

• js-fixed-delimiter-concat-obfuscation — the obfuscation technique used by this family
• wmi-hidden-process-powershell — the WMI execution procedure observed
• image-steganography-payload-delivery — concept of hiding payloads inside image files

Capabilities

• jscript-fixed-delimiter-concat-obfuscation
• wmi-hidden-process-spawn
• powershell-image-steganography-loader
• tls-1.2-payload-fetch
• reflective-dotnet-assembly-load
• base64-utf16le-encoded-powershell
• runtime-string-concatenation-method-resolution
• image-marker-extraction-start-end
• base64-character-substitution-anti-signature
• url-string-reversal-obfuscation
• github-raw-c2-config-staging
• builder-template-campaign-randomization