Malicious Script Delivering More Maliciousness, (Wed, Feb 4th)

This report analyzes a malicious email attachment that uses an obfuscated .bat/PowerShell dropper to fetch an innocuous-looking image, extract an embedded Base64 payload, and deploy a .NET XWorm infostealer. The malware establishes persistence via a scheduled task and communicates with its operator through a Telegram bot URL; the write-up provides the decoded sample SHA256, the C2 endpoint, and decoding steps used to recover the binary.