Huntress Traces Satoban Persistence to a Windows XP svchost.exe Copy

Jan 12, 2021 · Original article ↗

Summary

Huntress traced a Windows persistence mechanism to VBS/Satoban.A: a service used a Windows XP svchost.exe copy to launch an encoded VBScript, revealing malware behaviors including USB spreading, downloads, and shadow-volume deletion.

Key points

A Windows service registry entry pointed to an svchost.exe located in an unusual System32 subdirectory, rather than the standard location.
The executable was a legitimate Windows XP version of svchost.exe; its service configuration pointed investigators to a VBScript.
The VBScript launched a renamed copy of wscript.exe to execute the encoded blood.dat script.
Huntress identified the sample as VBS/Satoban.A, matching known research through its service details and created files and directories.
Analysis of the decoded script found code to spread through attached USB drives, download additional malware, and silently delete shadow volumes.
The article lists potential file and directory artifacts and reports that some listed web servers returned HTTP 200 responses and redirected investigators at the time of writing.

Article Details

Attack Vectors: Persistence through a Windows service configured with an ImagePath that launches svchost.exe from an unusual system subdirectory.
A renamed copy of wscript.exe launches an encoded VBScript payload.
The malware spreads to attached USB drives and contacts external web servers to download additional malware.
The VBScript silently deletes shadow volumes.
Defensive Notes: Inspect service ImagePath values and verify that svchost.exe is running from the expected Windows System32 location.
Do not rely on a successful virus scan alone; manually examine unusual binaries, service configuration, scripts, and related files.
Analyze encoded VBScript and check for the listed file paths and external URLs as potential indicators.

Indicators of compromise

Type	Indicator	Context
URL	`hxxp[:]//babybot[.]125mb[.]com/update.jpg`	URL listed among the external sites the malware may contact to download additional malware.
URL	`hxxp[:]//mysiteweb[.]eu5[.]org/system.jpg`	URL listed among the external sites the malware may contact.
URL	`hxxp[:]//mysiteweb[.]freezoy[.]com/explorer.jpg`	URL listed as malware-related; the article reports that it returned HTTP 200 and redirected the researcher through multiple sites.
URL	`hxxp[:]//newsonline[.]125mb[.]com/av.jpg`	URL listed among the external sites the malware may contact to download additional malware.
URL	`hxxp[:]//registered[.]co[.]nf/sat39/index.php`	URL listed among the external sites the malware may contact.
URL	`hxxp[:]//sauvegarde[.]1x[.]biz/booter.dat`	URL listed among the external sites the malware may contact to download additional malware.
URL	`hxxp[:]//users2[.]jabry[.]com/mysiteweb2/bump.jpg`	URL listed as malware-related; the article reports that it returned HTTP 200 and redirected the researcher through multiple sites.
URL	`hxxp[:]//zoneh[.]me[.]pn/zoneh.dat`	URL listed among the external sites the malware may contact to download additional malware.