There has been a glitch in the matrix. smica83 shared a heavily obfuscated .vbs which was first identified in Morocco, initially named "nouveau_cv_pdf.vbs".
I wasn't going to statically deobfuscate the piece of shit, so I emulated it. During emulation it catches it pulling a stage 2 binary from: https://qmlab1(.)com/assets/img/katyusha2
I curl the payload, look inside, and you're never going to believe it.
It's the exact same fucking binary I just discussed. It is the Go malware labeled internally as "EasyAgent"
I've never accidentally stumbled upon the same malware campaign, with different delivery methods, back to back like this. This is very silly
