NWH-Stealer-Analysis-Fileless-Bun-Runtime-Execution-Clipboard-Image-Theft-Cloud-C2-AWS-R2-

1. Binary Ninja – Open-Source Imitation & String Obfuscation

The NWH Stealer sample loaded in Binary Ninja reveals a surprising technique: it heavily utilizes strings, CLI arguments, and documentation links from Bun (a legitimate JavaScript runtime). By embedding legitimate text like "Learn more about Bun" and Discord invite links, the malware attempts to masquerade as a benign developer tool or framework, while hiding its true malicious intent in the .rdata section.

Key Observations:

bun install --help / bun test --help / bun build --help – mimics Bun CLI usage https://bun.com/docs / Join our Discord community: https://bun.com/discord – embeds official Bun documentation and community links. markdown / ToAsymmetricMatcher / Invalid regex: bunx – standard Bun error messages and test matchers. Obfuscation: The strings are interspersed with control characters and ANSI escape codes (e.g., [1m, [0m, \n), making static signature scanning difficult.

Why This Matters:

Living off the Land (LotL): By copying legitimate strings from the Bun runtime, NWH Stealer blends into developer environments. AV solutions and sandboxes are less likely to flag traffic or API calls originating from an execution environment that looks like "Bun". String Obfuscation: Embedding legitimate strings alongside encrypted or obfuscated payload arrays (data_143aba5b8) makes it much harder to isolate the actual malicious indicators. Evasion by Design: The malware authors specifically chose a popular, modern developer tool (Bun) to disguise the stealer's presence in developer or CI/CD environments.

Visual Reference:

2. Binary Ninja – Payload Download & PowerShell Execution

Continuing the analysis in Binary Ninja, the NWH Stealer reveals its dropper and execution chain. The malware does not just pretend to be Bun; it actively reaches out to the official GitHub repository to download the legitimate bun-windows-x64 archive. However, the subsequent strings expose a malicious PowerShell execution routine designed to run the downloaded payload with evasion flags.

Key Observations:

Download URL: https://github.com/oven-sh/bun/releases/download/canary/bun-windows-x64-baseline.zip – downloads the legitimate Bun runtime to establish a cover story or use as a LOLBin. Extracted Payload Paths: bun-windows-x64-baseline\bun-profile.exe bun-windows-x64-baseline\bun.exe PowerShell Execution Chain:

powershell

-NoProfile (skips loading the user's PowerShell profile)

-ExecutionPolicy Bypass (bypasses script execution restrictions)

-Command (executes the inline command)

--revision / --version (likely used as arguments to the downloaded payload to make it look like a legitimate version check).

Why This Matters:

Supply Chain / GitHub Abuse: By downloading from the official github.com/oven-sh/bun repository, the stealer bypasses network filters that block unknown domains. LOLBin Execution: The downloaded bun.exe or bun-profile.exe is used as a legitimate wrapper to execute malicious commands, blending in with normal developer activity. PowerShell Evasion: The flags -NoProfile and -ExecutionPolicy Bypass are classic techniques to ensure the malicious script runs without being blocked by system policies or user configurations.

Visual Reference:

3. Binary Ninja – Base64 Localhost Payload & In-Memory Execution

A critical section of the NWH Stealer's reveals its in-memory payload delivery mechanism. The presence of the http://localhost:data:;base64, string, combined with V8 engine bytecode (--filename, use asm, bytecode), indicates the stealer uses a fileless execution technique. It builds a Base64-encoded data URI and executes it locally, likely to inject malicious JavaScript/WebAssembly directly into a running environment without writing a file to disk.

Key Observations:

Data URI Scheme: http://localhost:data:;base64, – constructs an inline Base64 payload pointing to localhost. This is a known technique to bypass network filters and execute code from memory. V8 / Node.js / *Bun Internals: // @bun / bun-cjs / bytecode – specific flags used by the Bun runtime to execute JavaScript or pre-compiled V8 bytecode. --filename / --dirname / use asm – V8 engine flags used to load and optimize raw WebAssembly or JavaScript modules in memory. Compiled Payload Artifacts: bundler\bundle_v2.zig – references the Bun bundler, further solidifying the cover story. SEHRefreshSigS / SEHRefreshSigS_57azaspm – likely obfuscated function names or encryption keys for the Base64 payload. Fileless Injection Indicators: seTaskComplete.read_file / resolve – asynchronous file/stream reading and module resolution routines.

Why This Matters:

Fileless Execution (Evasion): By using a data:;base64 URI, the stealer executes its payload entirely in memory. This leaves no executable file on the disk for AV to scan, bypassing traditional signature-based detection. Localhost Abuse: The localhost prefix tricks firewalls and EDRs into thinking the traffic is internal (and therefore safe), while the actual malicious content is decoded and executed. V8 Bytecode Abuse: Loading bytecode via --filename and use asm means the stealer can execute raw, compiled JavaScript/WebAssembly, making reverse engineering significantly harder than plain text scripts. Bun Runtime Abuse: The // @bun and bun-cjs strings confirm the stealer is using the downloaded Bun runtime as a legitimate execution engine for its malicious in-memory code.

Living off the Cloud: By using legitimate cloud services (AWS, Cloudflare R2), the stealer blends its exfiltration traffic with normal enterprise cloud usage, making detection extremely difficul

Visual Reference:

4. Binary Ninja – Cloud Infrastructure Targeting & Exfiltration

The section further exposes NWH Stealer's targeting of cloud infrastructure and developer assets. Instead of relying on a single hardcoded C2 IP, the malware includes strings for major cloud providers (Cloudflare R2, AWS), developer toolchains (Visual Studio, Node.js), and HTTP status codes. This indicates a dynamic C2 resolution or an extensive credential harvesting list aimed at cloud environments.

Key Observations:

Cloud & C2 Infrastructure: r2.cloudflarestorage.com – Cloudflare R2 storage (used for data exfiltration or payload hosting). amazonaws.com – AWS infrastructure (likely targeted for credential theft or used as a C2 relay). us-east-1 – AWS region identifier (used for S3 bucket targeting). Developer / IDE Targets (Credential Harvesting): NDARD.STANDARD.TA.INTELLIGENT.I / ERING.EXPRESS..ONEZONE.ONEZONE.IA – Clearly obfuscated/fragmented strings referencing Visual Studio / IntelliJ. GLACIER.GLACIER.IR.REDUCED.REDU – AWS Glacier (backup/archive service) references. Cloud Permission Flags (For Lateral Movement / PrivEsc): private / public-read / private-read-write / aws-exec-read **bucket-owner-read **/ bucket-owner-full-control

Why This Matters: