Purpose : Analyzing The Malware Behaviour
Suspicious rar contains 3 files 2 are cleared and 1 (file).lnk is malicious {Deduce after investigation }. lets start investigation .(58ec917b5d2e14846f5a7948b7d9cd19)
Upon clicking (file).lnk, execute code from this URL (hXXp://av.msdefender.xyz/f)
from the code below we can see a file is being fetched from URL and then saving it to “C:\ Users\ public\ a.exe” and then get executed.
Taking sha256 sum and putting in virustotal no result found
Putting in pe studio get some info first of all its 32 bit and .NET binary (yahoo i
can get code to read rather than assembly its just faster :) ) and timestamp is a nono
compiled in the future wow time travel is at work here XD
Doing floss on it immediately cert pop-ups some sort of encrypted communication is in place.
let’s dig deeper opening it in dnspsy c2 server string “news.services-ms.info” and “cmd.exe” is in base64 (just my habit of going for base64 first )
two variable defined 1 integer and one char array (spoiler alert its certificate )
To start the process variables are set up from the look of it cmd.exe is being spawned there is no visual of opening cmd.exe. Program.CmdOutputDataHandler will be discussed later down and then programs sleep for 5000 seconds
Creating a string variable then resolving the domain name and putting it into a variable. Creating an encrypted connection to the given IP (46.30.188.175) and port (54289). The certificate which was provided in a char array
After the connection is established sleep for 1000 seconds.
Create a variable string that stores the received msg.
If receive string is “exit” kill itself. 
If receive string is “–SUICIDE”. It changes int “num” from zero to 100 then terminates. (i am really confused y making 2 things make do one thing )
If the string is “ACKNOWLEDGMENT” then the reverse shell is given to the author. The procedure is pretty simple stdin stdout and stderr of the “cmd.exe” process is buffer and then passed to the c2 server in encrypted form.
Not going over exception cases its logging errors (but not sending them to
c2 sever its odd ).
CMDOUTPUTDATAHAndler as the name suggests is taking cmd.exe output and
writing to a network stream.
Network connections to the above IP and port as found during the investigation.
IOC :
09cc7d0af801e5a3bebaa46a5b61bcc4eb133e2fe5159c65d47073c6a8163d80 ee2c4814e7f65fcf4c3f1f81bba41098d759def9073c88cc6d9927cfc312903e