Derp | Security Research

Multi-Stage PowerShell Loader Used Vercel-Hosted Payloads and Obfuscated Execution

Researchers documented a multi-stage PowerShell malware delivery chain that served script content directly from 203[.]188[.]171[.]166 and dorenzaa[.]com, then pulled additional payloads from Vercel-hosted infrastructure. The observed chain downloaded archives and executables including Grape2.zip, UltraToolliteSetup.exe, and draw.zip, extracted them into user directories such as %LOCALAPPDATA%\jsDownload and %APPDATA%, and launched files including Grape.exe. Investigators said the infrastructure behaved like a staged loader rather than a normal website, with multiple remote components used to fetch and run follow-on payloads. The PowerShell loaders used hidden execution, dynamically constructed IEX, Base64 decoding, and repeating-key XOR obfuscation with the key "write", while displaying a decoy prompt reading "Verification complete!" under the window title "Google.com". Analysts published indicators including the IP address, domain, file names, hashes, and execution paths, but said the initial infection vector and the ultimate functionality of several downloaded executables remained undetermined, and no threat actor attribution was made.