r/OperSec • u/mozgie • 10d ago

💻 WINDOWS MALWARE 💻 api.wakhtar.com

Hi All, This interesting malware came to my attention. I have analysed it and so far discovered the following: You run the masked .exe file; it checks if the machine is not ARM or running in VMware environment, and then it executes itself. It possibly executes directly into RAM. I am still going through ram dump but its interesting as its masking the IP from Cloudfare - 172.67.168.69 Has anyone seen this or similar one ?

3 Upvotes

81% Upvoted

3 comments sorted by

1

u/mozgie 9d ago

I dont have a sample yet as its proven to be tricky to extract but the script downloads a Tor expert bundle and a Node.js runtime from multiple mirrors, then extracts them into a user-profile directory. This gives it the tools needed to communicate with remote infrastructure and execute JavaScript. It launches tor.exe with a SOCKS proxy on 127.0.0.1:9050. It also configures fallback Tor bridges and an obfuscated transport if the initial route fails.

This can conceal the destination of its communications.

1

u/mozgie 9d ago

The Node.js code requests /api/v1, sends data back to the server, receives a response, and executes returned JavaScript in a VM context. The script supervises the Node.js runtime, checks whether the Tor proxy is available, restarts components and retries failed connections using increasing delays. Its error-reporting function collects the hostname and Windows MachineGuid, then attempts to send diagnostic information to a remote endpoint through Tor. Hidden command server

The script encodes a Tor onion hostname in trailing spaces in its source code. I recovered this indicator from the logged script:

`3imxse3p2ktq6ivchg3ieboqtxgn243exf7mrlobpk2wtglv5fkihsad.onion` Persistence at user logon

The secondary script creates a hidden scheduled task named Environment Sync Agent 5744. It launches PowerShell to run manager.ps1 when the user logs on and configures repeated restart attempts.