WARNING: This Repository Contains Malware

[Dogface2k]

┌─────────────────────────────────────────────────────────────────┐
│ STAGE 1: MSBuild PreBuildEvent (Batch Script) │
│ Triggered when user hits "Build Solution" (Ctrl+Shift+B) │
│ │
│ • Creates: %TEMP%\z3IdPT\ │
│ • Writes: IkA3CyZgY.vbs via obfuscated echo concatenation │
│ • Spawns: cscript //nologo "%TEMP%\z3IdPT\IkA3CyZgY.vbs" │
└───────────────────────────┬─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ STAGE 2: VBScript Decoder (IkA3CyZgY.vbs) │
│ │
│ • Uses MSXml2.DOMDocument.6.0 to decode Base64 → binary │
│ • Uses ADODB.Recordset for binary chunk handling │
│ • Writes decrypted payload to: %TEMP%\z3IdPT\PKCA.ps1 │
│ • Spawns: powershell.exe -ExecutionPolicy Bypass -File │
│ "%TEMP%\z3IdPT\PKCA.ps1" │
│ with window hidden (SW_HIDE = 0) │
└───────────────────────────┬─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ STAGE 3: PowerShell Decryptor (PKCA.ps1) │
│ │
│ • Defines fn "wd9L7u6kgnx" (PBKDF2-SHA256 key derivation) │
│ • Creates Rfc2898DeriveBytes(password, salt, iterations) │
│ • Defines fn "ftFfhZMIpO1" (AES-CBC-256 decryption) │
│ • Creates AesManaged in CBC mode with PKCS7 padding │
│ • Creates decryptor from derived key + IV │
│ • Decrypts Base64 blob → raw bytes │
│ • Converts to string → [Array]::Reverse() to deobfuscate │
│ • Creates alias "pWN" = Invoke-Expression │
│ • Calls pWN(decrypted_reversed_string) │
└───────────────────────────┬─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ STAGE 4: Unknown Final Payload │
│ │
│ • Executed via Invoke-Expression on the deobfuscated string │
│ • Base64 string "SW52b2tlLVY4cHJlc3Npb24=" → "Invoke-V8pression"│
│ (intentionally misspelled to evade string scanning) │
│ • Likely: RAT, info-stealer, crypto-miner, or botnet agent │
│ • Technique consistent with: Reflective .NET Assembly Load │
└─────────────────────────────────────────────────────────────────┘