Disrupting a phishing campaign

One of our clients recently received an email claiming an unpaid invoice required immediate action. The attachment was a RAR archive—an immediate red flag, especially as all recipients were undisclosed. Understandably, our client reached out to verify the legitimacy of the message.

Upon inspection, it was clear this was a phishing attempt. But what caught our attention was the fact that it had successfully bypassed the client’s mail filters. This warranted a deeper look into the attack chain and the threat actor’s tactics.

The Email

The attached RAR archive contained a single file: Unbezahlte Rechnung Nr.12417.wsf
This file, when opened, would be executed by wscript, the Windows Script Host, capable of executing javascript.

Upon inspecting the .wsf file, we found heavily obfuscated JavaScript.

After deobfuscating the script and decoding its string operations, it became evident that the malware leverages MSXML2.XMLHTTP via an ActiveXObject to download and execute a remote payload.

Following the hardcoded URL, we discovered an open directory at:
http://176.65.134.79/HOST/SIR.ps1

Let’s take a closer look at the PowerShell payload: SIR.ps1.

The script downloads an encrypted blob which, when base64-decoded, reveals a .NET binary.

This binary was packed using PROPacker, a known tool for obfuscation and anti-analysis.

To unpack it, we bypassed anti-debugging by setting breakpoints on IsDebuggerPresent and WriteProcessMemory.

Once WriteProcessMemory was hit, we found a full PE binary in memory:

---

AskaLoader: The Delivery Mechanism

The unpacked binary turned out to be AskaLoader, a malware loader that performs classic process hollowing.
It fetches encrypted PE payloads from a hardcoded server and injects them into legitimate processes.

Its decryption routine is minimalistic—a simple XOR loop with a hardcoded 32-byte key.

The loader embeds:

• the decryption key,
• the PE path,
• and the download URL directly in the binary.

While effective, the loader is far from stealthy. It leaks the XOR key wherever the binary contains null bytes.
Most payloads have a null-filled tail section, which reveals the repeating XOR pattern used for decryption.

Using this technique, we decrypted all payloads on the actor’s server:

• sirdeee.aska
• big77777.aska
• BAGSNAKE.aska
• k2.aska
• kentt.aska

The AskaLoader source code was even found publicly on GitHub: https://github.com/Tetedu27/AskaLoader

---

sirdeee.aska – Credential Harvesting via SMTP

This decrypted payload contains an instance of Agent Tesla, a known infostealer and RAT.

If the client had opened the initial .wsf, this payload would have been executed—stealing credentials and sending them via SMTP.

Interestingly, the actor used two email accounts on the same server—one for sending and one for receiving credentials.

We discovered an open cPanel interface for the domain and reset the password, effectively halting data exfiltration from this sample.

---

big77777.aska – Credential Exfiltration via FTP

Another Agent Tesla variant, this sample uploads stolen credentials to a remote FTP server.

We accessed the server and deleted all stored credentials, disrupting another part of the campaign.

---

BAGSNAKE.aska – Obfuscated Exfiltration Configuration

This sample also uses SMTP for credential theft, but the configuration is encrypted.

The decryption logic:

• computes an MD5 hash of a hardcoded string,
• takes the first 8 bytes as the DES key,
• and decrypts strings in ECB mode.

We extracted the following credentials:

• Sender: info@alnozha-qa.com (likely a compromised account)
• Receiver: armkmc2016@gmail.com (possibly a disposable Gmail account)

---

kentt_dec.aska & k2_dec.aska – REMCOS RAT

Two payloads turned out to be REMCOS, a commercially sold remote access trojan.
They were configured with the following settings:

Description	Value
License Serial	0D65ED8B19C4A976605F04835079F278
ID 1	Rmc-GV2YHK
ID 2	Rmc-068YU6
C2 Server Address	196.251.116.245:2721

---

Recommendations

The malicious infrastructure, including the server at 176.65.134.79, remains active.
The threat actor is still serving payloads and may continue campaigns using similar TTPs.

We recommend:

1. Blocking rarely-used script file types (.wsf, .js, etc.) at the email gateway level.
2. Allow only known-good formats with clear business use (e.g., .pdf, .xlsx, .csv).
3. Blacklisting the following IP addresses in your firewall or proxy configuration:
   • 176.65.134.79
   • 196.251.116.245

---

This case showcases how even basic malware with a poorly implemented encryption routine can bypass filters and execute in real-world environments.
Proactive analysis, combined with swift response, disrupted the attacker’s campaign and prevented credential leaks.

Stay tuned—we’ll continue to publish deep dives like this to help defenders stay one step ahead.

---

IOCs