Botnet Fenix

What it is

A DFIR.ch reverse-engineering walkthrough of a single Fenix botnet infection observed in an IR case. The value beyond the summary is the concrete IOCs and the specific deobfuscation move used to crack the JSE stage.

How it works

The chain: a Dropbox-hosted ZIP → LNK → wscript.exe pulls a JSE from a hardcoded SMB share → obfuscated JavaScript builds and executes a payload. The rfc.jse script assigns hundreds of single-character/fragment values to randomly-named variables, concatenates them into one string, then runs new Function(decodeURIComponent(...)).call(). Decoded, it reveals a second layer using the classic array-shift string-lookup pattern (_0x3eb2 accessor + a rotation loop that push/shifts an array until a parseInt checksum matches). The decoded logic drives an ActiveXObject (fields like MPdLc, an open-style call with URL/method args split by '|' in a switch state machine) to fetch and run shellcode.

Preconditions / Affected

Windows host where a user opens the LNK; wscript execution and outbound SMB to the attacker IP must be permitted. The lure vector (how the Dropbox link reached the user) was not determined in this case.

What to do

Use these as detection/blocking IOCs:

• SMB C2 / staging host: \\193.149.190.150\vWa\rfc.jse
• ComplementoSATid.zip — 70be0d4dd7ac04b699c7e035ead0e83941fc70906e6aa00384986b41f3ecbdee
• ComplementoSATid.lnk — 39641c701ce212fcae56e74cc46a00dc60a64ab4f9f27690e123e7e4109b3b6a
• rfc.jse — dcb647433c3f58a8406711da3e143dbb1fc4ee4e1cd436ce1ae5ff972d5a6a55

Detection hooks worth building: LNK spawning wscript.exe with a UNC path argument, and wscript reading .jse over outbound SMB. To triage similar JSE samples, the post's practical trick is to replace the terminal new Function(decodeURIComponent(x)).call() with console.log(decodeURIComponent(x)) to dump the next stage safely.

flowchart TD
    A[Dropbox ZIP] --> B[LNK]
    B -->|wscript + UNC arg| C[SMB share 193.149.190.150]
    C --> D[rfc.jse]
    D -->|decodeURIComponent + new Function| E[layer 2: array-shift deob]
    E -->|ActiveXObject| F[shellcode]
    B -.detect: LNK spawns wscript with UNC.-> B
    D -.swap Function for console.log.-> E

Caveats

This is one IR case, not a campaign survey; the initial delivery vector is unknown, and the author frames it as a skills exercise. The fetched page text is truncated mid-analysis, so the final shellcode/C2 behavior is only partially shown — see Metabase's referenced Fenix report for a documented infection vector.