Malware Analysis Space

  Summary   As we know, using obfuscated VBScript to execute obfuscated PowerShell  is a common technique in malware to evade detection and complicate analysis. This approach leverages the strengths of both scripting languages while making it harder for security tools and analysts to understand the malicious intent.   Recently I came across a malware that is very well-designed for these obfuscation techniques to use, which is so interesting and attracted my curiosity to learn more about what’s happened inside the malware, and it was also low detection rate until first discovered.   Below, I would like to share how the attackers use VBScript and PowerShell to evade detection, maybe it can help other malware researchers or analysts, and the common technique but new doing uncommon which being talked on both VBScript obfuscation and PowerShell obfuscation.     Technical analysis   Basic info The sample hashs: md5 0e513e80fc18...