THREAD for beginning malware/SOC analysts
When analyzing interpreted languages like PowerShell, JavaScript, VBA/VBS, there are some handy shortcuts to dealing with obfuscated code. (NOTE: Always do this kind of analysis in a sandbox VM off of your corporate network.)
When analyzing interpreted languages like PowerShell, JavaScript, VBA/VBS, there are some handy shortcuts to dealing with obfuscated code. (NOTE: Always do this kind of analysis in a sandbox VM off of your corporate network.)
Let's use this PowerShell script as an example (raw code on the right). The code is triggered with an obfuscated 'IEX' command that is reconstructed from a predictable PowerShell environment variable, $PSHome. 
To de-obfuscate the rest of of the script, replace 'IEX' with 'Write-Host'. This general approach, replacing an execution command with a print/write command, works in basically all interpreted languages. In this case, the output is more obfuscated PowerShell.
It's the same obfuscation techniques used in the original PowerShell script, but this time 'IEX' is reconstructed from $ShellId instead of $PSHome.
When we replace 'IEX' with 'Write-Host' and run the script this time, we get human-readable code that is the final payload.
Here is the de-obfuscated PowerShell beautified and marked up. It is a simple TCP reverse shell that executes any PowerShell provided by the attacker C2 server, the address and port of which is hardcoded in the Net.Sockets.TCPClient() call in the first line of the script.
And, no, I don’t feel the slightest bit bad about burning this Red Team’s C2 on Twitter.
