هیچی برگر [﷼]

oh sorry if youre a threat intel nerd, or anti malware nerd, who is designated to track potential state sponsored activity in south america final payload: 5a979c309aff96456ba4482653fc213997387956c24e376645e4e0cfaa6b878a obfuscated js payload (fragmented utf16le): 87eac5fa290387bd90d71424f8a65f2b2c7436a415f6e7f033915ef8e833ef86 file sent to colombia ppl i guess idk: 193b98595f44935e79413aeb474cd8d75e8d5ba63caf0d52470cadbeb8139c03 theyre all on VT now

> get dm > "government ppl in Colombia getting weird file" > lolwtf > send link > look inside > phishing page (looks good tho tbh) > image 1 > i dont speak spanish, idk wtf it says > look inside .html > .zip hidden inside it as base64 > lol ok > bonk with stick > "Oficio 2231" zip file > idk what that means still > look inside > .zip has .js inside of it > look inside > big ass fuck off obfuscated bs trying to trick u > image 2 > utf16 bullshit > utf16 makes another file > ??? > extract from tiny little fragments of js > look inside > .dll .net file > wtf lol > look inside > heavily obfuscated .net malware > image 3 > tiny .js fragments contain powershell script > ??? tl;dr .html does something that triggers .js which extracts .zip. the .js from .html executes the .js inside the .zip which reads the .ps script from the .js. the .ps then executes a c# .dll which is named taskscheduler (its malware) why would someone send government officials in Colombia this file wtf lol

this is the guy calling you the N word on discord

> get dm > "hey smelly, i work for (kind of important place)" > "vendor sent us weird file, its sus af" > "what do u think?" > download file > look inside > ultra mega fuck off malware > pe position independent .code is set to RWX > multiple extra sections > extracts .bss segment > .bss has .exe inside it > .exe ASPack 2 compressed > emulate > has anti-vm features > pulls .bat from c2 to self-delete > still bonking my brother in christ, if your company ran this .exe from this vendor, you better call someone ASAP because your company is COOKED. also, this vendor is either a criminal enterprise or compromised. gl big dawg. happy monday

▓▓▓▓▓▓▓▓▓░░░░░░░░░░░ 49%

original payload: https://gist.github.com/vxunderground/91da9c50e400a6742bbacd1548a255d8

> be SmartLoader > big ass fuck off malware campaign > tracked by dozens of anti malware companies > heavily obfuscated lua > bamboozles everyone > me jimmies rustled > team up with roblox cheater nerd > reverse engineer it back to src > (almost done) https://gist.github.com/vxunderground/aaa6a88823afc83b4f8a73366694966d

My deepest condolences to my colleagues in Venezuela and those impacted by the recent earthquakes. I wish I had more to offer other than words. I hope you're all doing well and I hope you're all safe.