LausivLoader Malware Uses Environment Variables for Multi-Stage Attacks
The SANS Internet Storm Center has analyzed LausivLoader, a malware that employs a novel technique of passing data between its initial JavaScript stage and a subsequent PowerShell stage using environment variables.
Researchers at the SANS Internet Storm Center have detailed the inner workings of LausivLoader, a malware family observed in a recent malspam campaign. The attack begins with a seemingly innocuous JavaScript file disguised as a purchase order. Upon closer inspection, this JavaScript file contains a significant amount of commented-out text, which, after deobfuscation, reveals code designed to execute a PowerShell command.
The JavaScript payload is designed to be complex, but by analyzing the latter parts of the script, researchers found it constructs a command line that invokes conhost.exe. This executable then launches PowerShell with a Base64-encoded command. The purpose of this encoded command is to retrieve and concatenate the contents of two environment variables, Kv7408 and Kv562, which are expected to contain further stages of the malware.
What makes this technique particularly interesting is how these environment variables are populated. The initial JavaScript code dynamically creates a temporary directory and then writes the contents of two large strings into files within that directory. Crucially, it then sets the Kv7408 and Kv562 environment variables within its own process to point to these newly created files. Since child processes typically inherit their parent's environment, the subsequent PowerShell process, launched via conhost.exe, gains access to these paths.
Once the PowerShell script has access to the file paths, it reads the content of both files, concatenates them, decodes the resulting Base64 string, and then executes the payload. This multi-stage approach allows the malware authors to obfuscate the full payload and potentially evade detection by breaking the attack into smaller, less suspicious components. The JavaScript stage also includes logic to delete the temporary files and the environment variables it created, aiming to clean up its tracks.
The analysis highlights a sophisticated method for inter-process communication and data exfiltration. By leveraging environment variables, LausivLoader avoids hardcoding paths or relying on more common methods like registry keys or temporary files directly accessible by the second stage. This approach adds a layer of complexity for security analysts trying to piece together the entire attack chain.
The initial malspam email, which contained the JavaScript attachment, was designed to impersonate a legitimate business communication, further increasing the likelihood of user interaction. While the email itself had some technical flaws, such as failed SPF and DMARC checks, the malicious attachment was the primary vector of infection.
This analysis underscores the evolving tactics used by malware authors to bypass security measures. The use of environment variables for passing payloads is a less common but effective technique that allows for modularity and obfuscation, making it harder for security tools to detect the complete malicious operation. Further analysis of the decoded PowerShell script would reveal the ultimate objective of the LausivLoader campaign, which could range from information theft to further system compromise.