VBSNetReflectionLoader 61806a90 -- VBScript-6710-lines BinaryFormatter-deserialization AAEAAAD-header PowerShell-Editor-assembly Base64-chunk-concatenation ricewithoutwatch dugshellslungs randomized-function-names | Orta

파일 Kimligi

VBS Yukleyici 아키텍처

1. Yuzlerce VBS fonksiyonu her biri bir Base64 parcasi dondurur:\n   Public Function enddealthem()\n     enddealthem="AAEAAAD/////AQAAAAAAAAAMAgAAAF5..."\n   Public Function pilotshotluck()\n     pilotshotluck="ZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2..."\n   (Yuzlerce farkli isimli fonksiyon...)\n\n2. Ana blok butun parcalari birlestiriyor:\n   ricewithoutwatch = ricewithoutwatch & enddealthem()\n   ricewithoutwatch = ricewithoutwatch & pilotshotluck()\n   ... (50+ birlesim satirlari)\n\n3. Sonuc: tum payload bir degiskende\n4. Yukleme: dugshellslungs ricewithoutwatch, 60040

.NET BinaryFormatter Payload

enddealthem ilk Base64 cozumu:\n  AAEAAAD/////  ->  00 01 00 00 00 FF FF FF FF\n  Bu .NET BinaryFormatter seri deserializasyon basligi!\n\nMicrosoft.PowerShell.Editor icerigi:\n  "Microsoft.PowerShell.Editor, Version=3.0.0.0"\n  => PowerShell host sinifi yuklemesi\n\nSystem.Windows.Forms yukleme:\n  "System.Windows.Forms, Version=4.0.0.0"\n\n.NET Reflection API dize parcalari:\n  GetBytes, GetFlags, AssemblyName, ProcessModule\n  GetExports, CallInstructionAddresses, objectAttributes

Anti-Analiz Teknikleri

Tum fonksiyon isimleri rastgele anlaml sozcuk kombinasyonlari:\n  enddealthem, pilotshotluck, tropicalnosort\n  shownbroughttraffic, behaviormachineshells\n  ricewithoutwatch, fortystockspecies...\n\nPayload parca parca dagilmis (60-80 parcaya bolunmus)\nHicbir URL/IP cleartext olarak gorulmuyor\n(C2 .NET assemblyde gizlenmis)

IOC