- https[:]//djcs.ybuu.ru/8PB830a3IXi78o9/
- https[:]//26qw8.hicx0.com/72w0/
- https[:]//5f460.dkx01.com/373i/
- https[:]//1826x.eauth0.com/499p/
- https[:]//discovery.expedownhe.com/fg7n232/
- https[:]//874pf.eaver1.com/h538/
- https[:]//s8k47.moraspu.ru/02b3/
- https[:]//melody.lincelryou.com/y48633m/
- https[:]//721cj.ckasmi1.com/h319/
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hxxps://prezi[.]com/i/hcfsww85oy-x/12-jan-tax_flllng_2o24/ | |
hxxps://filetransfer[.]io/data-package/r2JfVdB0/download | |
hxxp://s25[.]filetransfer[.]io/storage/download/7j1einWjDhd9 | |
hxxp[://]139[.]28[.]37[.]124:222/g[.]jpg | |
AsyncRAT 70683619f9aa40df2f6bd90b33d4084d6bc989cda83967d45b769196dcad880b |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// CyberChef Recipe to deobfuscate Gootloader encoded string | |
// Use: https://github.com/drole/CyberChef | |
Unescape_string() | |
Gootloader_Decode() | |
JavaScript_Beautify('\\t','Auto',true,true) | |
Regular_expression('User defined','\\(\'(.*?)\'\\)',true,true,false,false,false,false,'List capture groups') | |
Unescape_string() | |
Gootloader_Decode() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Function GenerateFilePath() As String | |
pathPropertyName = "Path" | |
pathSeparator = "\" | |
index = 2 | |
documentPath = CallByName(ActiveDocument, pathPropertyName, index) | |
currentTime = GetFormattedTime() | |
GenerateFilePath = documentPath & pathSeparator & currentTime | |
End Function | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
def decode(encoded_string): | |
reversed = encoded_string[::-1] | |
decoded = "" | |
decoded_reversed = "" | |
for idx in range(int(len(reversed))): | |
if idx % 2: | |
decoded = decoded + reversed[idx] | |
else: | |
decoded_reversed = decoded_reversed + reversed[idx] | |
return decoded + decoded_reversed[::-1] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
var j = [ | |
'WScript.Shell', | |
'Scripting.FileSystemObject', | |
'Shell.Application', | |
'Microsoft.XMLHTTP' | |
]; | |
var g = [ | |
'HKCU', | |
'HKLM', |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
firefox.exe | |
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\ | |
SOFTWARE\Mozilla\Mozilla Firefox | |
SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command | |
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe | |
%appdata%\Mozilla\Firefox\Profile}[Ýã\ | |
MozillaFireFox | |
CurrentVersion | |
Install_Directory | |
nss3.dll |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// shellcode.cpp : Defines the entry point for the console application. | |
// | |
// Shellcode_dnstxt.cpp : Defines the entry point for the console application. | |
// | |
#include "stdafx.h" | |
#include<stdio.h> | |
#include<windows.h> | |