#ESETresearch has detected a new MSIL loader, named
#BlackHawk, protected by three layers of obfuscation, all of which show strong signs of being AI-generated.
The first layer is a VBS script. It stands out due to its clean formatting, overly complex implementation, meaningful function and variable names, and clear comments and sectioning, features typical for AI-generated code.
The second layer is a PowerShell script that begins with comments accurately describing its functionality, and multiple implementations of the same decryption function, along with multiple execution methods – another potential residue of AI fine-tunning.
The third layer is another PowerShell script containing a base64-encoded BlackHawk loader and the final payload. AI-generated artifacts are evident in this stage too, similar to those observed in the earlier layers.
ESET researchers have observed BlackHawk being used in spearphishing campaigns to deliver
#AgentTesla, targeting hundreds of endpoints in Romanian small and medium-sized companies.
The name BlackHawk is based on the main class name of the loader (BLACKHAWK.DOWN), version information, and a PDB file (blackhawk.pdb), all indicating the developer also using this naming.
Researchers at K7 have also observed
#BlackHawk being deployed in another campaign, with only slight variations in the obfuscation layers across different samples. This offers further evidence of prompt engineering techniques used to optimize stealth.
https://labs.k7computing.com/index.php/phantom-3-5-initial-vector-analysis-forensics/ This discovery illustrates another area that attackers can potentially improve by using generative AI - namely code protection. In the case of BlackHawk, however, the deployment of these techniques was rather heavy-handed.
IoCs: 39C2E88D3F8E5EB5F2829420861209C5B33F26A1 The first layer of BlackHawk 86B55EFF8EE238161EF34A99086F6D1E482595E4 BlackHawk loader