Javascript - Deobfuscating a Turla JS Backdoor

Objectives

In addition to common obfuscation techniques, malware authors will also use passwords to slow down analysis. Analyze this JavaScript file and see if you can deobfuscate the first stage! This JavaScript file was originally dropped by a malicious office document.

Please note - use of open-source intelligence will be needed to fully unravel this backdoor :)

The exercise files are in a password-protected archive using a password of: infected

Solutions and walk-through analysis is provided here.

This exercise is also available on the CyberDefenders platform as a CTF challenge.

Want to know when the next challenge is released? Follow me on Twitter!

Challenge Questions

Sample MD5: e12624fb6270a01eb8bb0308ce57ab45

1. What variable holds the next stage of code?

2. What function is responsible for executing the deobfuscated second stage?

3. What is the "key" needed to unravel the second stage?

4. What does the function LXv5 do?

5. What does the function CpPT do?

Sample information

MITRE ATT&CK Techniques: T1566 Phishing -> T1566.001 Spearphishing Attachment

Suggested Tools

All of the necessary tools are installed in the REMnux distribution.

• Terminal/Command prompt w/ Python installed
• CyberChef
• Text editor
• Search engine – you will need to rely on open-source information to solve this lab

Additional Educational Resources

• YouTube - Using Visual Studio to Debug JavaScript via Windows Script Host (WSH)

Solution and Walk-Through

Solution and Walk-Through

License

This content is licensed under CC BY-NC-SA 4.0.