MSI Madness: Unpacking a Malicious PowerShell Payload
Inspecting an MSI package led us on a wild malware chase, revealing hidden PowerShell code and the notorious SectopRat. Moral of the story? Don’t trust MSI packages.
Hot Take:
MSI packages: The surprise gift boxes of the digital world! You never know if you’re getting a software update or an unwelcome malware family reunion. This is why “just click it” is a terrible strategy.
Key Points:
– **MSI Package Analysis:** The suspicious MSI package was identified with low VirusTotal scores but contained malicious PowerShell scripts.
– **Execution Hurdles:** The package failed to run due to a “bootstrapper” error, suggesting language or installation code issues.
– **Custom Actions:** The MSI file used the Custom Action table to execute various PowerShell commands.
– **Malware Payloads:** Involved multiple payloads, including a SectopRat and Redline stealer, disguised within image files.
– **Persistence Mechanism:** Employed a scheduled task to maintain persistence on the infected system.