Analysis Details Multi-Stage WsgiDAV Campaign Using Fake Italian Agency Email
Summary
Researchers traced a phishing campaign from a ZIP shortcut through WebDAV-delivered loaders to a decrypted payload injected into explorer.exe. C2 settings were retrieved from Pastebin; a possible XWorm link remains unconfirmed.
Key points
- A phishing email impersonating Italy’s ANBSC agency led recipients to a ZIP containing a Windows .url shortcut.
- Opening the shortcut triggered a WebDAV-over-TLS download chain: a .wsh loader, JavaScript stage, and batch orchestrator.
- The batch stage opened a legitimate PDF decoy, relaunched hidden through PowerShell, and established persistence via the user’s Startup folder.
- An embedded Python runtime and a script applied three successive XOR operations to decrypt the payload, which was injected into explorer.exe.
- The analysis found that C2 settings were retrieved dynamically from Pastebin; community submissions referenced the same C2 on ports 6000, 7000, and 8000.
- The C2 was associated with XWorm by a ThreatFox community user, but researchers did not recover a definitive XWorm assembly and could not confirm the attribution.
Article Details
- Attack Vectors
- A phishing email impersonating an Italian agency linked to a redirect chain and a ZIP archive containing a Windows .url shortcut.
- Opening the shortcut triggered a WebDAV-over-TLS download of elcqjyp.wsh, which loaded uweepyj.js and qidctgy.bat.
- The JavaScript stage downloaded and executed the batch orchestrator, which opened a legitimate tax-themed PDF decoy and relaunched itself hidden with PowerShell.
- The batch stage established persistence through a batch file in the user's Startup folder, downloaded sb.py, new.bin, and a.txt, and used XOR operations to decrypt the payload.
- The decrypted payload was injected into explorer.exe using CreateProcessA, VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and ResumeThread.
- The payload retrieved C2 configuration dynamically from Pastebin. The report says community submissions associated the C2 with XWorm, but attribution was not confirmed.
MITRE ATT&CK
T1055.004 · Asynchronous Procedure CallThe decrypted payload was injected into explorer.exe using QueueUserAPC after process creation and memory writing.T1059.001 · PowerShellThe batch orchestrator relaunched itself hidden using PowerShell with -WindowStyle Hidden.T1059.003 · Windows Command ShellThe JavaScript stage launched qidctgy.bat with cmd /c.T1059.007 · JavaScriptThe uweepyj.js stage used Windows Script Host COM objects, including Scripting.FileSystemObject and WScript.Shell.T1090 · ProxyThe report says the remote .wsh hosting domain was exposed through Cloudflare Tunnel.T1102 · Web ServiceThe payload retrieved its C2 configuration dynamically from Pastebin entries rather than using an address hardcoded in the binary.T1105 · Ingress Tool TransferThe shortcut and subsequent stages downloaded the .wsh, JavaScript, batch, and payload-related files from remote infrastructure over WebDAV.T1140 · Deobfuscate/Decode Files or InformationThe sb.py script applied three sequential XOR operations using keys from a.txt to decrypt new.bin.T1204.002 · Malicious FileThe infection chain began when the recipient opened the ZIP's .url shortcut, triggering remote retrieval.T1547.001 · Registry Run Keys / Startup FolderThe campaign placed an additional batch file in the user's Startup folder to run at login.T1566.002 · Spearphishing LinkThe phishing email contained a link that led through redirects to a ZIP archive containing the malicious .url shortcut.
Malware
Vendors
Products
Cloudflare Tunnelaccess via WebDAV on TLS’ and ‘the URL points to a .wsh script hosted on a domain exposed via Cloudflare Tunnel’)Microsoft WindowsThe initial vector was a phishing email impersonating an Italian agency (ANBSC) with a link that led to a ZIP containing a Windows .url shortcut.PastebinAnalysis revealed dynamic retrieval of C2 configuration from Pastebin and indicators linking the infrastructure to activity associated with the XWorm botnet, though attribution is not definitive.PythonPersistence was achieved by creating %LOCALAPPDATA%mrbqm, installing an embedded Python runtime (python.exe 3.14.0) if absent, and placing a startup batch in the user’s Startup folder.