LevelBlue Traces Multi-Vector Malware Campaign Using VBS, PowerShell and PNG-Embedded Loaders
Summary
LevelBlue analysts traced a reusable malware delivery framework using obfuscated VBS, fileless PowerShell, PNG-embedded .NET loaders, and a separate fake-PDF shortcut chain. SentinelOne prevented execution of the initially detected VBS file.
Key points
- SentinelOne detected and quarantined an obfuscated VBS file before its execution completed; analysts found no related activity in the environment’s historical telemetry.
- The VBS decoded a Base64 PowerShell command that retrieved PNG files containing appended, Base64-encoded .NET assemblies loaded directly into memory.
- The loader, identified as PhantomVAI, retrieved payloads including Remcos RAT and a UAC-bypass DLL; exposed directories on news4me[.]xyz hosted scripts and payloads associated with XWorm and other malware.
- A separate delivery chain used a ZIP archive masquerading as a PDF but containing an Internet Shortcut, along with batch scripts and Cloudflare-backed hosting.
- Sandbox analysis of the secondary chain observed Python payloads, memory injection, shellcode execution, and outbound network activity; VirusTotal classified artifacts as Python-based trojans in the Kramer family.
- LevelBlue says it implemented custom detections for related VBS loaders, PNG-embedded payload staging, and associated infrastructure; it also recommends restricting risky scripts and monitoring in-memory execution.
Article Details
- Attack Vectors
- An obfuscated VBS launcher reconstructed and executed a Base64-encoded PowerShell command that retrieved a PNG containing an appended .NET loader.
- The PhantomVAI loader decoded payloads and loaded assemblies in memory, delivering malware including Remcos RAT and XWorm variants.
- A separate chain used a ZIP archive masquerading as a PDF and containing an Internet Shortcut that directed execution to attacker-controlled WebDAV infrastructure.
- A batch script retrieved additional ZIP, BAT, and TXT payloads; sandbox analysis observed Python-based components with memory-injection and shellcode-execution behavior.
- Defensive Notes
- Restrict execution of high-risk script types such as VBS and BAT, particularly from user-writable directories.
- Constrain PowerShell use and monitor in-memory execution techniques.
- Block or tightly control WebDAV traffic to disrupt Internet Shortcut-based delivery.
- Consider TLD-based filtering for .xyz domains where practical; the investigation also implemented detections for related VBS loaders, PNG-embedded payload staging, and associated infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | adapter-chess-gently-residential[.]trycloudflare[.]com | Cloudflare-backed host serving a TXT file identified as executable batch logic. |
| DOMAIN | aye-knights-copyrights-nominations[.]trycloudflare[.]com | Cloudflare-backed host associated with a WebDAV-hosted script used in secondary-stage execution. |
| DOMAIN | bacteria-spent-endless-grammar[.]trycloudflare[.]com | Cloudflare-backed host used by the malicious Internet Shortcut for payload retrieval. |
| DOMAIN | css-direct-excel-highlights[.]trycloudflare[.]com | Cloudflare-backed host used to serve payload files in the secondary infection chain. |
| DOMAIN | news4me[.]xyz | Attacker-controlled domain hosting open directories and malware delivery and staging files. |
| DOMAIN | shirts-june-gratis-repository[.]trycloudflare[.]com | Cloudflare-backed host serving secondary-stage ZIP and TXT payloads. |
| DOMAIN | tammhdka[.]cloud | Host used to serve malicious BAT and ZIP payloads. |
| DOMAIN | tammhdka[.]pro | Alternate host for secondary-stage malicious ZIP and TXT payloads. |
| SHA1 | 08e3321955194964bd1e3784691e2d62055f6860 | Hash of 1UK-Vioooo.py, a Python payload dropped during the secondary infection chain. |
| SHA1 | 0e4dbc00d72f228afe9ee58499f70f3f9bbfcebe | Hash of a ZIP payload retrieved by the malicious batch script. |
| SHA1 | 1e0ab184a8941ab4d5e3552237061019a06b3cca | Hash listed for coupon.vbs, one of the obfuscated loader scripts in the attacker’s infrastructure. |
| SHA1 | 274ed28bd083feb5600297a1728a4063d6b415ad | Hash of a Unicode-obfuscated VBS script identified as pulling down additional malware. |
| SHA1 | 314b42be5ce942dd1c3d0bddb0cc6e0cdcb1acad | Hash of 44rrr.bat, identified as an obfuscated batch script that retrieved malicious archives. |
| SHA1 | 63a7cc185c023c2e52519df9aa530fb2c35a2d8f | Hash of 1aaaaannnov24.py, a Python payload dropped during the secondary infection chain. |
| SHA1 | 69fe62c8af8eefddf48eef454929c4fae7f2f2a6 | Hash of a decoded XWorm variant. |
| SHA1 | 905578853c8880da35d97e599cb0168cf3bf74f8 | Hash listed for the 700ff.vbs script in the attacker’s loader infrastructure. |
| SHA1 | 961c4c69cfaca6f085a67cd5ee3a4b7b5dc4422f | Hash of a decoded XWorm variant. |
| SHA1 | 98cdfb464d8a98e07479909dd1db04eec849e94e | Hash of the ZIP archive containing an Internet Shortcut masquerading as a PDF. |
| SHA1 | a4a3d9ac1df13736a29a615fc86b5f3835aba11d | Hash of the PNG containing the appended PhantomVAI .NET loader. |
| SHA1 | a55d61fb7fe814afeab4f4d7f42be4cf60609414 | Hash of UAC.dll, identified as a malicious DLL used for UAC bypass and privilege escalation. |
| SHA1 | c214e2cde87d614daceb2cdcbf4ff88fa24a1d43 | Hash of uac.png, which contained an appended UAC-bypass DLL. |
| SHA1 | eaedebdc23056fa4964a75d35bf20f9dd179a582 | Hash of the decoded ScorpioRAT malware. |
| SHA1 | ffe9a4a3daaa5773e324014d0282d4c6bbbc1da2 | Hash of johnremcos.txt, an attacker-hosted staging file containing an encoded Remcos RAT payload. |
| URL | hxxp[:]//ia600606[.]us[.]archive[.]org/11/items/msi-pro-with-b-64_20251030/MSI_PRO_with_b64.png | Specific PNG URL identified as hosting the PhantomVAI loader embedded in image data. |
| URL | hxxps[:]//news4me[.]xyz/protector/johnremcos.txt | Attacker-hosted text payload that was decoded to produce a Remcos RAT variant. |
| URL | hxxps[:]//news4me[.]xyz/uac.png | Attacker-hosted PNG containing an embedded UAC-bypass DLL. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe VBS launcher used heavy Unicode obfuscation and Base64-encoded content to conceal its functionality.T1036 · MasqueradingA ZIP containing an Internet Shortcut was presented as a PDF, and the shortcut itself was disguised as a PDF.T1053.005 · Scheduled TaskThe in-memory loader orchestrated persistence through scheduled tasks.T1055 · Process InjectionTelemetry associated with the Python components included memory injection and shellcode execution.T1059.001 · PowerShellThe VBS reconstructed and executed a Base64-encoded PowerShell command that retrieved remote content.T1059.003 · Windows Command ShellThe secondary infection chain executed batch scripts to retrieve and run additional payloads.T1059.005 · Visual BasicThe initial VBS file acted as an obfuscated launcher for the PowerShell loader.T1059.006 · PythonPython-based payloads were dropped during the secondary chain, with telemetry indicating their execution and follow-on activity.T1105 · Ingress Tool TransferThe scripts and loaders retrieved PNG, ZIP, BAT, and TXT payloads from attacker-controlled and Cloudflare-backed infrastructure.T1140 · Deobfuscate/Decode Files or InformationThe loaders reversed and Base64-decoded text payloads and decoded Base64 assemblies appended to PNG files.T1204 · User ExecutionThe fake-PDF Internet Shortcut and ZIP delivery path relied on user interaction to trigger further execution.T1548.002 · Bypass User Account ControlThe loader retrieved a DLL identified as a UAC-bypass component used to facilitate privilege escalation.T1620 · Reflective Code LoadingThe PhantomVAI .NET assembly was loaded directly into memory using Reflection.Assembly::Load.
Malware
Kramer[Python files ] dropped payloads used in secondary chain – 1UK-Vioooo.py (08E3321955…), 1aaaaannnov24.py (63A7CC185C…), and additional Python hashes indicating Kramer-family detections.PhantomVAIframework that used obfuscated VBS launchers, a fileless PowerShell loader, PNG-embedded .NET loaders (PhantomVAI), and openly hosted directories to stage and deliver multiple payload families.Remcos RATThe campaign delivered and rotated payloads including Remcos RAT and XWorm variants from attacker-controlled infrastructure such as news4me[.]xyz and Cloudflare-backed hosts, enabling additional infection paths via aScorpioRATScorpioRAT malware from johnscorpio.txt once decodedXWormThe campaign delivered and rotated payloads including Remcos RAT and XWorm variants from attacker-controlled infrastructure such as news4me[.]xyz and Cloudflare-backed hosts, enabling additional infection paths via a