unclassified-js-bitbucket-stego-dropper
JScript dropper family using fixed-delimiter string-concatenation obfuscation, WMI hidden-process execution, and image-steganography payload delivery. First observed sample 56ea37ef (2026-07-08).
Overview
This family represents a Windows Script Host (JScript) dropper that conceals a PowerShell payload inside hundreds of += concatenation lines interleaved with a fixed noise token. The PowerShell stage downloads a .NET assembly hidden inside image or text files using steganography markers, then reflectively loads it in-memory.
Build Stack
- Language: JScript (Windows Script Host)
- Obfuscation: Custom fixed-delimiter string concatenation (no commercial packer)
- Launcher: WMI (
Win32_Process.CreatewithShowWindow = 0) - Stage 2: PowerShell (TLS 1.2, image-steganography fetch, Base64 decode,
[Assembly]::Load) - Stage 3: Custom .NET assembly (
myprogram.Homees) - Signing: None
Deploy / TTPs
- T1059.005 — Visual Basic (JScript via WSH)
- T1059.001 — PowerShell
- T1027.001 — Obfuscated files or information (noise-token padding)
- T1564.003 — Hide Artifacts (hidden window via WMI)
- T1105 — Ingress Tool Transfer (HTTPS payload fetch)
- T1071.001 — Application Layer Protocol (HTTPS)
- T1620 — Reflective Code Loading (.NET assembly)
Variants / Aliases
Scan000342.js— scanned-document lure
Notable Analyses
56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81— First observed sample; Bitbucket + paste.sensio.no image-steganography carriers. ^[/intel/analyses/56ea37ef9e4ae2bb4d0e11b84ba3aea650a55018cd3430d6c75f0a5ef6815d81.html]
Related
- js-fixed-delimiter-concat-obfuscation — the obfuscation technique used by this family
- wmi-hidden-process-powershell — the WMI execution procedure observed
- image-steganography-payload-delivery — concept of hiding payloads inside image files
Capabilities
- jscript-fixed-delimiter-concat-obfuscation
- wmi-hidden-process-spawn
- powershell-image-steganography-loader
- tls-1.2-payload-fetch
- reflective-dotnet-assembly-load
- base64-utf16le-encoded-powershell
- runtime-string-concatenation-method-resolution
- image-marker-extraction-start-end