2024-10-19 Eco-Friendly (Malware)

The script is really broken down into 2 parts.

The first part contains iex invoke, and charcode obfuscation, in the the second half, the size just made it difficult and my system was already slow.

We take the second half and run in Windows PowerShell, not Linux PowerShell or pwsh.

It outputs like this , so we pipe to a new file.

Find replace \r\n with “,” and get an idea what’s going on.

So we write a script to start decoding, here are a few sections showing the large data chunks in the 2 variables.

Outputs more encoded values.

So we replace and decode again.

This outputs more nested data.

See more nested data, replace the script with the next values

Last nest, 4 times total.

Final decode

flag{8ba43de1e095287dbbf7722e51239a63}

Other screenshots

$references ='{39}{23}{26}{13}{21}{16}{17}{14}{27}{9}{22}{3}{12}{1}{5}{20}{8}{38}{37}{7}{30}{6}{34}{11}{18}{4}{36}{19}{0}{24}{28}{32}{40}{35}{31}{25}{29}{33}{2}{15}{10}' 

$charArray = @([char]55,$env:ComSpec[22],[char]54,[char]52,$env:PUBLIC[11],$env:ProgramFiles[14],[char]56,[char]53,$env:ComSpec[15],$env:PUBLIC[11],[char]125,$env:ComSpec[22],$env:ComSpec[17],[char]102,[char]123,$env:ComSpec[17],$env:ProgramFiles[8],$env:CommonProgramFiles[6],$env:PUBLIC[11],[char]55,[char]49,$env:ProgramFiles[13],$env:ProgramData[11],[char]35,$env:ComSpec[18],$env:ComSpec[17],$env:CommonProgramFiles[10],[char]56,$env:ComSpec[18],[char]57,$env:ComSpec[18],$env:ComSpec[18],$env:PUBLIC[5],$env:CommonProgramW6432[8],[char]55,[char]49,[char]102,[char]57,[char]48,$env:CommonProgramW6432[23],[char]53)

function Get-CharacterFromReference {
    param(
        [string]$reference,
        [array]$charArray
    )
    
    $index = [int]($reference -replace '[{}]', '') % $charArray.Count
    
    return $charArray[$index]
}

$result = $references -split '}{' | ForEach-Object {
    $_ = '{' + $_ + '}'  # Fix format after splitting
    Get-CharacterFromReference -reference $_ -charArray $charArray
}

# Print the final concatenated string
Write-Host $($result -join '')
$result -join '' | Out-File -FilePath '2output.txt'

$references = '{39}{23}{26}{13}{21}{16}{17}{14}{27}{9}{22}{3}{12}{1}{5}{20}{8}{38}{37}{7}{30}{6}{34}{11}{18}{4}{36}{19}{0}{24}{28}{32}{40}{35}{31}{25}{29}{33}{2}{15}{10}'

$charArray = @([char]55,$env:ComSpec[22],[char]54,[char]52,$env:PUBLiC[11],$env:ProgramFiles[14],[char]56,[char]53,$env:ComSpec[15],$env:PUBLiC[11],[char]125,$env:Comspec[22],$env:Comspec[17],[char]102,[char]123,$env:Comspec[17],$env:ProgramFiles[8],$env:CommonProgramFiles[6],$env:PUBLiC[11],[char]55,[char]49,$env:ProgramFiles[13],$env:ProgramData[11],[char]35,$env:Comspec[18],$env:ComSpec[17],$env:CommonProgramFiles[10],[char]56,$env:Comspec[18],[char]57,$env:Comspec[18],$env:Comspec[18],$env:PUBLiC[5],$env:CommonProgramW6432[8],[char]55,[char]49,[char]102,[char]57,[char]48,$env:CommonProgramW6432[23],[char]53)

function Get-CharacterFromReference {
    param(
        [string]$reference,
        [array]$charArray
    )
    
    $index = [int]($reference -replace '[{}]', '') % $charArray.Count
    
    return $charArray[$index]
}

$result = $references -split '}{' | ForEach-Object {
    $_ = '{' + $_ + '}'  # Fix format after splitting
    Get-CharacterFromReference -reference $_ -charArray $charArray
}

# Print the final concatenated string
Write-Host $($result -join '')