> Family · Unclassified JS S3 Dropper_

~/packetpursuit $ cat /intel/families/unclassified-js-s3-dropper.md

typeentityfamilyunclassified-js-s3-dropperconfidencemediumcreated2026-06-16updated2026-06-23scriptdropperc2loaderdefense-evasion

Unclassified JS S3 Dropper

Minimal plaintext JScript dropper family that uses Windows Script Host COM objects (WScript.Shell, MSXML2.ServerXMLHTTP.6.0, ADODB.Stream) to download a remote PE executable from an Amazon S3 bucket over HTTPS, stage it to %TEMP%, and execute it hidden. Characterised by the deliberate disabling of SSL certificate validation (setOption(2,13056)), a size gate (>=1024 bytes), and zero obfuscation. Single observed sample as of June 2026; low-confidence family attribution.

Capabilities

  • wscript-shell-environment-expansion
  • msxml2-serverxmlhttp-https-download
  • adodb-stream-binary-write
  • ssl-cert-bypass-setoption-13056
  • temp-directory-payload-staging
  • random-filename-generation
  • size-gate-anti-empty-check
  • hidden-window-execution
  • bare-catch-error-suppression
  • s3-virtual-hosted-endpoint-c2
  • xor-byte-array-obfuscation-js-eval

Build / RE

  • Language: JScript for Windows Script Host
  • Obfuscation: None — fully readable plaintext
  • Anti-analysis: None observed
  • Code quality: Minimal but functional; ~600 bytes, single line, no dead code
  • COM object chain: WScript.Shell → MSXML2.ServerXMLHTTP.6.0 → ADODB.Stream

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.005 .js carrier executed by WScript/CScript ^[/intel/analyses/26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f.html]
Defense Evasion T1203 WScript.Shell COM object abuse ^[/intel/analyses/26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f.html]
Defense Evasion T1218 wscript.exe / cscript.exe proxy execution ^[/intel/analyses/26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f.html]
Defense Evasion T1562.001 SSL certificate validation disabled via setOption(2,13056) ^[/intel/analyses/26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f.html]
Command & Control T1071.001 HTTPS GET to S3 endpoint ^[/intel/analyses/26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f.html]
Ingress Tool Transfer T1105 Downloads remote PE to local disk ^[/intel/analyses/26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f.html]

Infrastructure

  • URL: https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/UtilifySetup.exe
  • Domain: amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com — attacker-controlled S3 virtual-hosted bucket with masquerade naming
  • Region: us-west-1 — hardcoded in endpoint
  • SSL handling: All server certificate errors ignored (SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS)
  • No backup URLs / DGA / fallback C2 observed.

Sibling Analyses

  • 26afa8d11ece77de51b54648010198884238cbddd4230cf9008903e2d4f1352f — First observed sample: 612-byte plaintext JS, Utilify-themed S3 downloader (see report)
  • 2dbebbafe9d931b6a9ed9401aaf06acb31d341413f77adecb7c7e4e0e904de9f — Second sibling: identical inner payload wrapped in XOR byte-array obfuscation (sw.js, 2541 bytes); key 204; medium-confidence cluster (n=2) ^[/intel/analyses/2dbebbafe9d931b6a9ed9401aaf06acb31d341413f77adecb7c7e4e0e904de9f.html]

Related