LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)
SANS dissects a LausivLoader JavaScript malspam sample that passes staged payload file paths to PowerShell via process environment variables.
SANS analyzed a LausivLoader JavaScript sample caught in a customer's mail gateway from an August malspam campaign impersonating a fiber-optic procurement inquiry. The roughly 613 KB attachment (28/55 VirusTotal detections) hides code among 450 junk comment lines, drops two files into a randomized %TEMP% directory, and passes their paths to a PowerShell payload via process environment variables Kv7408 and Kv562. The final command launches PowerShell through conhost.exe with a Base64-encoded command; the script also copies itself and attempts to register a scheduled task.
- Delivered via malspam with an .r01 archive containing a JS purchase-order attachment
- Obfuscation includes 450 junk comment lines and String.fromCharCode construction
- Stage handoff uses environment variables to pass file paths between JS and PowerShell
- Final command runs conhost.exe to launch hidden PowerShell with -EncodedCommand
- Sample had a 28/55 VirusTotal detection rate at time of analysis
- ATT&CK
- T1566.001 Spearphishing AttachmentT1059.007 JavaScript/JScriptT1059.001 PowerShellT1053.005 Scheduled TaskT1027 Obfuscated Files or Information
- Malware
- LausivLoader
- Organizations
- SANS Internet Storm Center
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | wscript.network | crosoftEdgeUpdateTaskCore'. var v6116=WScript.CreateObject("WScript.Network"); var v6190=v6116.UserDomain+"\\"+v6116.UserName; var v184 |
| domain | yapw.life | guration reveals the following download location: hxxps[:]//yapw[.]life/phpt/stego_zrgaixkku8.png At the time of writing, the URL |
| md5 | 5d92d1fb5d5fbd79a588f22e994a4aff | beebce416f66954b9fa9 First .NET loader - 315,904 bytes MD5: 5d92d1fb5d5fbd79a588f22e994a4aff e4130bf8769a50106a963b6a43dfd4fe5b56c70eae76a0de971d2599315 |
| md5 | 7acd5c5f1689332615c03357e143f51e | Files PO.4843293191 For Supply Chain - Imports HM..js MD5: 7acd5c5f1689332615c03357e143f51e SHA-256: 408b2df6e81824fa5bdf4f0fbd185a7e6db06e2be98fbeebce |
| md5 | f351968c76eefc80d4e292a3f179b7b9 | 971d25993159acfe Second .NET downloader - 59,904 bytes MD5: f351968c76eefc80d4e292a3f179b7b9 SHA-256: be73e8b06c4356b5b4644d69b4f426bb3b32b4bf9f14cc5743 |
| sha256 | 408b2df6e81824fa5bdf4f0fbd185a7e6db06e2be98fbeebce416f66954b9fa9 | it needs to do it… [1] https://www.virustotal.com/gui/file/408b2df6e81824fa5bdf4f0fbd185a7e6db06e2be98fbeebce416f66954b9fa9 [2] https://isc.sans.edu/diary/Passive+analysis+of+a+phishi |
| sha256 | be73e8b06c4356b5b4644d69b4f426bb3b32b4bf9f14cc5743f17532799f760b | 59,904 bytes MD5: f351968c76eefc80d4e292a3f179b7b9 SHA-256: be73e8b06c4356b5b4644d69b4f426bb3b32b4bf9f14cc5743f17532799f760b URL hxxps://yapw[.]life/phpt/stego_zrgaixkku8.png TTPs T156 |
| sha256 | e4130bf8769a50106a963b6a43dfd4fe5b56c70eae76a0de971d25993159acfe | oader - 315,904 bytes MD5: 5d92d1fb5d5fbd79a588f22e994a4aff e4130bf8769a50106a963b6a43dfd4fe5b56c70eae76a0de971d25993159acfe Second .NET downloader - 59,904 bytes MD5: f351968c76eefc80 |
| url | https://yapw.life/phpt/stego_zrgaixkku8.png | its configuration reveals the following download location: hxxps[:]//yapw[.]life/phpt/stego_zrgaixkku8.png At the time of writing, the URL was no longer live, nev |
From the original article
8 min read at isc.sans.edu
At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The message was not especially remarkable – it asked the recipient to review some attached requirements and provide a price quotation for a fiber optic system and appeared to impersonate an employee of a legitimate company.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.